Vulnerability Description
TinyOS versions up to and including 2.1.2 contain a stack-based buffer overflow vulnerability in the mcp2200gpio utility. The vulnerability is caused by unsafe use of strcpy() and strcat() functions when constructing device paths during automatic device discovery. A local attacker can exploit this by creating specially crafted filenames under /dev/usb/, leading to stack memory corruption and application crashes.
Related Weaknesses (CWE)
References
- https://github.com/tinyos/tinyos-main
- https://seclists.org/fulldisclosure/2026/Jan/14
- https://www.vulncheck.com/advisories/tinyos-stack-based-buffer-overflow-in-mcp22
FAQ
What is CVE-2026-22212?
CVE-2026-22212 is a documented vulnerability. TinyOS versions up to and including 2.1.2 contain a stack-based buffer overflow vulnerability in the mcp2200gpio utility. The vulnerability is caused by unsafe use of strcpy() and strcat() functions w...
How severe is CVE-2026-22212?
CVSS scoring is not yet available for CVE-2026-22212. Check NVD for updates.
Is there a patch for CVE-2026-22212?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.