The vulnerability exists in the Bosch Sensortec BHI360 SensorAPI (C-Library) version 2.1.0 within the function bhi360_parse_debug_message() in bhi360_parse.c. The parser trusts the first payload byte of a debug frame as the message length and copies that many bytes into a fixed 17-byte stack buffer without bounds checking. This stack-based buffer overflow can be triggered by a locally or physically positioned attacker who injects a crafted debug frame with a length byte greater than 16. The overflow corrupts adjacent stack data including the saved return address. Because the overflowed buffer is passed to a printf-style logging function, an attacker can supply format string specifiers to execute arbitrary code on the host microcontroller or cause a system crash (denial of service).

Successful exploitation can lead to arbitrary code execution on the host microcontroller or system-on-chip, or cause a reliable denial of service via system crash. The attack requires local or physical access, such as a malicious sensor, counterfeit hardware module, or man-in-the-middle on the communication bus. The vulnerability compromises confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, restrict physical and local access to the device and communication bus to trusted entities to reduce risk of exploitation.