CVE-2026-22212: TinyOS <= 2.1.2 Stack-Based Buffer Overflow in mcp2200gpio
TinyOS versions up to and including 2.1.2 contain a stack-based buffer overflow vulnerability in the mcp2200gpio utility. The vulnerability is caused by unsafe use of strcpy() and strcat() functions when constructing device paths during automatic device discovery. A local attacker can exploit this by creating specially crafted filenames under /dev/usb/, leading to stack memory corruption and application crashes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TinyOS (mcp2200gpio)to a version that resolves this vulnerability.Fixed in 2.1.2 - Compensating control
Prevent local attackers from creating specially crafted filenames under /dev/usb/ (e.g., restrict access/permissions to the /dev/usb/ path used for automatic device discovery).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22212?
CVE-2026-22212 has a high severity rating due to the stack-based buffer overflow that can lead to code execution.
How do I fix CVE-2026-22212?
To fix CVE-2026-22212, upgrade to a version of TinyOS that is higher than 2.1.2 where the vulnerability is patched.
What systems are affected by CVE-2026-22212?
CVE-2026-22212 affects TinyOS versions up to and including 2.1.2, particularly in the mcp2200gpio utility.
What type of vulnerability is CVE-2026-22212?
CVE-2026-22212 is a stack-based buffer overflow vulnerability caused by unsafe string manipulation functions.
Who is impacted by CVE-2026-22212?
Users and developers using TinyOS versions 2.1.2 and earlier are impacted by CVE-2026-22212.