Buffer overflow in Tinyos
CVE-2026-22212
TinyOS versions up to and including 2.1.2 contain a stack-based buffer overflow vulnerability in the mcp2200gpio utility. The vulnerability is caused by unsafe use of strcpy() and strcat() functions when constructing device paths during automatic device discovery. A local attacker can exploit this by creating specially crafted filenames under /dev/usb/, leading to stack memory corruption and application crashes.
Vulnerability class: Buffer Overflow
Published · last modified .
EPSS exploit prediction
EPSS: 0.001 (2.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 3rd percentile — 2.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.001 · newest: 0.001 · change: +0.000
Affected products
- Tinyos — versions 0
Weakness classification (CWE)
References
- seclists.org/fulldisclosure/2026/Jan/14 (technical-description, exploit)
- github.com/tinyos/tinyos-main (product)
- www.vulncheck.com/advisories/tinyos-stack-based-buffer-overflow-in-mcp2200gpio (third-party-advisory)