The Bosch BHI385 SensorAPI contains a critical stack-based buffer overflow vulnerability that could allow an attacker to trigger a denial of service or achieve arbitrary code execution.

This is a stack-based buffer overflow (CWE-121) occurring in the bhi385_parse_debug_message function. An attacker can supply a malicious event payload with an unchecked length byte, causing a memory write beyond the allocated stack buffer during the memcpy operation.

The vulnerability carries a CVSS score of 8.4, reflecting the significant risk of system compromise. Successful exploitation could lead to total loss of device integrity, including persistent firmware crashes or the execution of unauthorized code, which may result in severe operational disruption or loss of control over connected sensor hardware.

Immediate Action: Monitor the official Bosch PSIRT security advisory page for the release of a patched version of the SensorAPI and apply the update as soon as it becomes available.

Proactive Monitoring: Review firmware logs and system telemetry for unexpected crashes or errors originating from the sensor bus interface.

Compensating Controls: Ensure that access to the sensor bus is restricted to trusted hardware components to mitigate the risk of a malicious participant injecting crafted payloads.

Public Exploit Available: No (exploit_available: unknown)

Given the potential for arbitrary code execution and the severity of this memory corruption flaw, organizations utilizing the BHI385 SensorAPI must prioritize this issue in their patch management cycle. Until a vendor-supplied patch is deployed, restrict hardware access to authorized components to reduce the attack surface.