CVE-2026-22212

UNKNOWN 0.0

TinyOS <= 2.1.2 Stack-Based Buffer Overflow in mcp2200gpio

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

TinyOS versions up to and including 2.1.2 contain a stack-based buffer overflow vulnerability in the mcp2200gpio utility. The vulnerability is caused by unsafe use of strcpy() and strcat() functions when constructing device paths during automatic device discovery. A local attacker can exploit this by creating specially crafted filenames under /dev/usb/, leading to stack memory corruption and application crashes.

CWE	CWE-121
Vendor	tinyos
Product	tinyos
Published	Jan 12, 2026
Last Updated	Jul 14, 2026

Stay Ahead of the Next One

Get instant alerts for tinyos tinyos

Be the first to know when new unknown vulnerabilities affecting tinyos tinyos are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

TinyOS / TinyOS

0 ≤ 2.1.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

seclists.org: https://seclists.org/fulldisclosure/2026/Jan/14 github.com: https://github.com/tinyos/tinyos-main vulncheck.com: https://www.vulncheck.com/advisories/tinyos-stack-based-buffer-overflow-in-mcp2200gpio

Credits

Ron Edgerson