CVE-2026-42804
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A stack-based buffer overflow in the Bosch Sensortec BHI360 SensorAPI (C library) in versions up to and including commit d6b200416a. The vulnerability is in the FIFO parsing and debug logging subsystem within bhi360_parse_debug_message() in bhi360_parse.c (lines 1852-1875); the parser trusts the first payload byte as the message length and copies that many bytes into a fixed-size 17-byte stack buffer via memcpy without bounds checking. A locally or physically positioned attacker can inject a crafted debug frame with a length byte exceeding 16, corrupting adjacent stack data including the saved return address; because the overflowed buffer is subsequently passed to a printf-style logging sink, the attacker can supply format string specifiers (e.g., %n) to execute arbitrary code on the host microcontroller/SoC or cause a reliable system crash (DoS).
Risk Assessment
An attacker with local or physical access can corrupt stack memory and potentially execute arbitrary code on the host device, leading to full compromise or reliable denial of service.
Recommendation
Update BHI360 SensorAPI to a version that fixes the vulnerability, or restrict physical access and the use of untrusted sensors and hardware modules.
Related vulnerabilities
- CVE-2026-61567Critical
In AVideo before 8.1.0, the live-streaming endpoint `view/videosListToLive.php` trusts attacker-supplied data in `webSiteRootURL` as session state, allowing an unauthenticated attacker to self-grant `isLogged` and `canStream`. Video-list paths are interpolated without escaping into `ffprobe` and `ffmpeg` commands executed via `exec`, enabling OS command injection. This is fixed in version 8.1.0.
- CVE-2026-61564Critical
In AVideo before 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `videos/configuration.php` by interpolating request parameters, including `webSiteRootURL`, into single-quoted PHP literals without escaping. An attacker can terminate a literal and inject PHP executed as the web-server user. Exploitation requires `videos/configuration.php` to be absent, and database parameters can point to an attacker-controlled server. This is fixed in version 8.1.0.
- CVE-2026-118690Critical
Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the `/skServer/ziplogs` endpoint. Attackers can extract the JWT `secretKey` from `security.json` in the ZIP, forge administrator tokens, and create persistent admin accounts. This is fixed in version 2.33.0.
- CVE-2026-63190Critical
Prior to version 0.1.4, FearlessCMS contains five debug/test PHP scripts under admin/ that perform privileged operations without authentication, CSRF protection, or adequate path validation. On PHP's built-in server (including the default Docker deployment), the /./admin/ path bypasses the login gate, enabling arbitrary .md writes, directory enumeration, stored/reflected XSS, and disk exhaustion.
- CVE-2026-117574Critical
In ai-gateway-payload-processing, an authenticated remote attacker can specify another tenant's model identifier in the request body or header. The service does not verify authorization before retrieving credentials from the shared store, so it injects the target tenant's API keys into the request.
- CVE-2026-118264Critical
In the Echo Go web framework from 4.0.0 until 4.16.1 and in 5.4.1, the Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream, bypassing Echo's router and route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes.
- CVE-2026-103409Critical
A missing authentication for a critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root. The vulnerability can only be exploited prior to the device being onboarded to Mist/Conductor; it can no longer be exploited once the device is onboarded.
- CVE-2026-103406Critical
An improper neutralization of special elements used in an OS command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID.
- CVE-2026-44179Critical
The `excerpt-include` macro in XWiki Remote Macros does not properly escape the included page's title and executes `excerpt` content with the macro's rights. Both the title handling and the rendering of `excerpt` content into XWiki syntax allow syntax injection. Any user able to edit a page, even without script rights, can supply executable macro syntax and cause remote code execution when the page is included.
- CVE-2026-115968Critical
A deserialization of untrusted data vulnerability in the Ultimate Member WordPress plugin allows Object Injection. Affects versions up to and including 2.13.1.
Original NVD description (English source)
A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPI(C-Library) in versions up to and including commit d6b200416a. The vulnerability is located within the FIFO parsing and debug logging subsystem inside the function bhi360_parse_debug_message() in bhi360_parse.c (lines 1852-1875). The parser trusts the first payload byte of a debug frame as the message length (msg_length) and copies that many bytes into a fixed-size 17-byte stack buffer (debug_msg) via memcpy without performing any bounds checking. A locally or physically positioned attacker (e.g., via a malicious sensor, counterfeit hardware module, or a Man-in-the-Middle on the communication bus) can exploit this vulnerability by injecting a crafted debug frame with a length byte exceeding 16. This corrupts adjacent stack data, including the saved return address. Furthermore, because the overflowed buffer is subsequently passed to a printf-style logging sink, the attacker can supply format string specifiers (e.g., %n) to execute arbitrary code on the host microcontroller/SoC or cause a reliable system crash (Denial of Service).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS