The Bosch BME690 SensorAPI C-driver up to version 1.0.3 contains an out-of-bounds read vulnerability in the read_all_field_data function. The driver prefetches heater configuration registers into a 30-byte stack buffer. When parsing sensor data, the gas_index is extracted using a 4-bit mask but is not checked to ensure it is within the valid range of 0 to 9. An attacker or a compromised peripheral device on the I2C/SPI bus could supply a gas_index of 10 or greater, causing the driver to read up to 6 bytes beyond the stack buffer boundary. This out-of-bounds data is then written into a public gas_wait field, which could result in measurement corruption or leakage of adjacent stack memory when the data is logged or transmitted.

The vulnerability allows an attacker or malicious peripheral device to cause the driver to read memory beyond the intended buffer, potentially leaking sensitive stack data. This can corrupt sensor measurement data or expose adjacent stack memory contents, which may be logged or telemetered. The CVSS score of 4.3 reflects a moderate impact with limited confidentiality, integrity, and availability effects. There is no indication of remote code execution or privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should ensure that only trusted peripherals are connected to the I2C/SPI bus to prevent malicious payload injection. Monitoring for anomalous sensor data may help detect exploitation attempts. Avoid relying on untrusted sensor data sources.