CVE-2026-22211

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22211", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-01-06T16:47:17.187Z", "datePublished": "2026-01-14T15:19:54.833Z", "dateUpdated": "2026-07-14T15:53:17.049Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-14T15:53:17.049Z"}, "title": "TinyOS <= 2.1.2 Global Buffer Overflow in printfUART", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "TinyOS versions up to and including 2.1.2 contain a global buffer overflow vulnerability in the printfUART formatted output implementation used within the ZigBee / IEEE 802.15.4 networking stack. The implementation formats output into a fixed-size global buffer and concatenates strings for %s format specifiers using strcat() without verifying remaining buffer capacity. When printfUART is invoked with a caller-controlled string longer than the available space, the unbounded sprintf/strcat sequence writes past the end of debugbuf, resulting in global memory corruption. This can cause denial of service, unintended behavior, or information disclosure via corrupted adjacent global state or UART output."}], "value": "TinyOS versions up to and including 2.1.2 contain a global buffer overflow vulnerability in the printfUART formatted output implementation used within the ZigBee / IEEE 802.15.4 networking stack. The implementation formats output into a fixed-size global buffer and concatenates strings for %s format specifiers using strcat() without verifying remaining buffer capacity. When printfUART is invoked with a caller-controlled string longer than the available space, the unbounded sprintf/strcat sequence writes past the end of debugbuf, resulting in global memory corruption. This can cause denial of service, unintended behavior, or information disclosure via corrupted adjacent global state or UART output."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "lang": "en", "type": "CWE"}]}], "affected": [{"defaultStatus": "unknown", "packageURL": "pkg:github/tinyos/tinyos-main", "product": "TinyOS", "repo": "https://github.com/tinyos/tinyos-main", "vendor": "TinyOS", "versions": [{"lessThanOrEqual": "2.1.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 5.1, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "references": [{"tags": ["technical-description", "exploit"], "url": "https://seclists.org/fulldisclosure/2026/Jan/14"}, {"tags": ["product"], "url": "https://github.com/tinyos/tinyos-main"}, {"tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/tinyos-global-buffer-overflow-in-printfuart"}], "credits": [{"lang": "en", "type": "finder", "value": "Ron Edgerson"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "source": {"discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-14T15:34:04.191428Z", "id": "CVE-2026-22211", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T15:35:01.567Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22211", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-14T15:34:04.191428Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T15:34:54.514Z"}}], "cna": {"title": "TinyOS <= 2.1.2 Global Buffer Overflow in printfUART", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Ron Edgerson"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/tinyos/tinyos-main", "vendor": "TinyOS", "product": "TinyOS", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.1.2"}], "packageURL": "pkg:github/tinyos/tinyos-main", "defaultStatus": "unknown"}], "references": [{"url": "https://seclists.org/fulldisclosure/2026/Jan/14", "tags": ["technical-description", "exploit"]}, {"url": "https://github.com/tinyos/tinyos-main", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/tinyos-global-buffer-overflow-in-printfuart", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "TinyOS versions up to and including 2.1.2 contain a global buffer overflow vulnerability in the printfUART formatted output implementation used within the ZigBee / IEEE 802.15.4 networking stack. The implementation formats output into a fixed-size global buffer and concatenates strings for %s format specifiers using strcat() without verifying remaining buffer capacity. When printfUART is invoked with a caller-controlled string longer than the available space, the unbounded sprintf/strcat sequence writes past the end of debugbuf, resulting in global memory corruption. This can cause denial of service, unintended behavior, or information disclosure via corrupted adjacent global state or UART output.", "supportingMedia": [{"type": "text/html", "value": "TinyOS versions up to and including 2.1.2 contain a global buffer overflow vulnerability in the printfUART formatted output implementation used within the ZigBee / IEEE 802.15.4 networking stack. The implementation formats output into a fixed-size global buffer and concatenates strings for %s format specifiers using strcat() without verifying remaining buffer capacity. When printfUART is invoked with a caller-controlled string longer than the available space, the unbounded sprintf/strcat sequence writes past the end of debugbuf, resulting in global memory corruption. This can cause denial of service, unintended behavior, or information disclosure via corrupted adjacent global state or UART output.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-14T15:53:17.049Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22211", "state": "PUBLISHED", "dateUpdated": "2026-07-14T15:53:17.049Z", "dateReserved": "2026-01-06T16:47:17.187Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-01-14T15:19:54.833Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "packageURL": "pkg:github/tinyos/tinyos-main", "product": "TinyOS", "repo": "https://github.com/tinyos/tinyos-main", "vendor": "TinyOS", "versions": [{"lessThanOrEqual": "2.1.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "TinyOS versions up to and including 2.1.2 contain a global buffer overflow vulnerability in the printfUART formatted output implementation used within the ZigBee / IEEE 802.15.4 networking stack. The implementation formats output into a fixed-size global buffer and concatenates strings for %s format specifiers using strcat() without verifying remaining buffer capacity. When printfUART is invoked with a caller-controlled string longer than the available space, the unbounded sprintf/strcat sequence writes past the end of debugbuf, resulting in global memory corruption. This can cause denial of service, unintended behavior, or information disclosure via corrupted adjacent global state or UART output."}, {"lang": "es", "value": "Las versiones de TinyOS hasta la 2.1.2 inclusive contienen una vulnerabilidad de desbordamiento de b\u00fafer global en la implementaci\u00f3n de salida formateada printfUART utilizada dentro de la pila de red ZigBee / IEEE 802.15.4. La implementaci\u00f3n formatea la salida en un b\u00fafer global de tama\u00f1o fijo y concatena cadenas para los especificadores de formato %s usando strcat() sin verificar la capacidad restante del b\u00fafer. Cuando se invoca printfUART con una cadena controlada por el llamador m\u00e1s larga que el espacio disponible, la secuencia sprintf/strcat sin l\u00edmites escribe m\u00e1s all\u00e1 del final de debugbuf, lo que resulta en corrupci\u00f3n de memoria global. Esto puede causar denegaci\u00f3n de servicio, comportamiento no deseado o revelaci\u00f3n de informaci\u00f3n a trav\u00e9s de un estado global adyacente corrupto o salida UART."}], "id": "CVE-2026-22211", "lastModified": "2026-07-14T16:16:49.113", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22211", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-14T15:34:04.191428Z", "version": "2.0.3"}}]}, "published": "2026-01-14T16:15:56.950", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/tinyos/tinyos-main"}, {"source": "disclosure@vulncheck.com", "url": "https://seclists.org/fulldisclosure/2026/Jan/14"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/tinyos-global-buffer-overflow-in-printfuart"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T16:17:47.515599+00:00", "value": {"mitigation_remediation": ["Upgrade to a TinyOS release newer than 2.1.2 or apply the vendor\u2019s security patch for printfUART overflow if available", "Modify the printfUART source to enforce bounds checking on the global buffer before concatenating strings", "If upgrading is not immediately possible, disable or restrict use of the printfUART routine in production deployments"], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "All installations of TinyOS 2.1.2 and earlier are vulnerable. No newer versions are affected.", "description_and_impact": "TinyOS versions up to 2.1.2 contain a global buffer overflow in the printfUART implementation used by the ZigBee / IEEE 802.15.4 stack. The function writes formatted output into a fixed\u2011size global buffer and concatenates %s strings with strcat() without checking remaining capacity. When called with a longer user\u2011controlled string, the unbounded write corrupts global memory, which can lead to denial of service, unintended behavior, or information disclosure through corrupted adjacent state or UART output.", "risk_and_exploitability": "The CVSS score of 5.1 indicates moderate severity. The EPSS score is below 1\u202f%, suggesting a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to control the string passed to printfUART, and the likely attack vector is via the UART debugging interface where the vulnerable function is invoked. If successfully triggered, the attacker can cause the device to crash or leak sensitive data."}}}}, "created": "2026-01-15T08:03:48.891965+00:00", "updated": "2026-04-18T16:30:05.071041+00:00", "vendors": ["tinyos", "tinyos$PRODUCT$tinyos"]}