CVE-2026-42808 affects Bosch Sensortec COINES_SDK versions 2.0 through 2.11. The vulnerability arises because coines_read_stream_sensor_data() does not validate the destination buffer size before copying data from the streaming ring buffer. Internally, comm_intf_process_stream_response() ignores the requested number_of_samples and copies all accumulated streaming data into a fixed buffer, which is then memcpy'ed without size checks into the caller's buffer. A malicious hardware board connected via USB or BLE can exploit this by sending a high volume of sensor samples, triggering a heap or stack-based buffer overflow on the host system. This can lead to denial of service or potentially arbitrary code execution.

Successful exploitation can cause a denial of service due to buffer overflow conditions or potentially allow arbitrary code execution on the host machine running the vulnerable COINES_SDK. The vulnerability requires a malicious or compromised hardware board connected via USB or BLE to trigger the overflow by streaming excessive sensor data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid connecting untrusted or potentially compromised hardware boards to hosts running affected versions of COINES_SDK. Monitor vendor channels for updates and apply official patches once released.