Key Information about the Vulnerability Severity: Medium Date: January 12, 2026 Affected: TinyOS <= 2.1.2 CVE: CVE-2026-22212 CVSS V3.1 Score: 6.0 CVSS V3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/SC:L/CI:N/II:N/A:L CWE: CWE-121 Stack-based Buffer Overflow References: - Researcher SecLists Disclosure - TinyOS GitHub Repository Credit: Ron Edgerson Description: TinyOS versions up to and including 2.1.2 contain a stack-based buffer overflow vulnerability in the mcp2200gpio utility. The vulnerability is caused by unsafe use of strcpy() and strcat() functions when constructing device paths during automatic device discovery. A local attacker can exploit this by creating specially crafted filenames under /dev/usb/, leading to stack memory corruption and application crashes.