8.0high
SecMateSECMATE-2026-0035
VendorBosch Sensortec
ProductCOINES SDK
VectorCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWECWE-122
Advisories
Timeline
Reported
Nov 11, 2025
Published
Aug 31, 2026
Summary
COINES SDK versions 2.10 through 2.12.2 trust a packet length supplied by a connected USB or BLE device before copying the response into a fixed-size host queue slot. A malicious or compromised peripheral can trigger an out-of-bounds heap write, causing a process crash or potentially arbitrary code execution on the developer workstation.