CVE-2026-22211

TinyOS versions up to and including 2.1.2 contain a global buffer overflow vulnerability in the printfUART formatted output implementation used within the ZigBee / IEEE 802.15.4 networking stack. The implementation formats output into a fixed-size global buffer and concatenates strings for %s format specifiers using strcat() without verifying remaining buffer capacity. When printfUART is invoked with a caller-controlled string longer than the available space, the unbounded sprintf/strcat sequence writes past the end of debugbuf, resulting in global memory corruption. This can cause denial of service, unintended behavior, or information disclosure via corrupted adjacent global state or UART output.

CVSS

No CVSS.

References

Link	Resource
https://github.com/tinyos/tinyos-main
https://seclists.org/fulldisclosure/2026/Jan/14
https://www.vulncheck.com/advisories/tinyos-global-buffer-overflow-in-printfuart

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) Las versiones de TinyOS hasta la 2.1.2 inclusive contienen una vulnerabilidad de desbordamiento de búfer global en la implementación de salida formateada printfUART utilizada dentro de la pila de red ZigBee / IEEE 802.15.4. La implementación formatea la salida en un búfer global de tamaño fijo y concatena cadenas para los especificadores de formato %s usando strcat() sin verificar la capacidad restante del búfer. Cuando se invoca printfUART con una cadena controlada por el llamador más larga que el espacio disponible, la secuencia sprintf/strcat sin límites escribe más allá del final de debugbuf, lo que resulta en corrupción de memoria global. Esto puede causar denegación de servicio, comportamiento no deseado o revelación de información a través de un estado global adyacente corrupto o salida UART.

14 Jan 2026, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-14 16:15

Updated : 2026-06-17 10:19

NVD link : CVE-2026-22211

Mitre link : CVE-2026-22211

CVE.ORG link : CVE-2026-22211

JSON object : View

Products Affected

No product.

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2026-22211", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22211", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-14T15:34:04.191428Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/tinyos/tinyos-main", "vendor": "TinyOS", "product": "TinyOS", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.1.2"}], "defaultStatus": "unknown"}]}], "published": "2026-01-14T16:15:56.950", "references": [{"url": "https://github.com/tinyos/tinyos-main", "source": "disclosure@vulncheck.com"}, {"url": "https://seclists.org/fulldisclosure/2026/Jan/14", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/tinyos-global-buffer-overflow-in-printfuart", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "TinyOS versions up to and including 2.1.2 contain a global buffer overflow vulnerability in the printfUART formatted output implementation used within the ZigBee / IEEE 802.15.4 networking stack. The implementation formats output into a fixed-size global buffer and concatenates strings for %s format specifiers using strcat() without verifying remaining buffer capacity. When printfUART is invoked with a caller-controlled string longer than the available space, the unbounded sprintf/strcat sequence writes past the end of debugbuf, resulting in global memory corruption. This can cause denial of service, unintended behavior, or information disclosure via corrupted adjacent global state or UART output."}, {"lang": "es", "value": "Las versiones de TinyOS hasta la 2.1.2 inclusive contienen una vulnerabilidad de desbordamiento de b\u00fafer global en la implementaci\u00f3n de salida formateada printfUART utilizada dentro de la pila de red ZigBee / IEEE 802.15.4. La implementaci\u00f3n formatea la salida en un b\u00fafer global de tama\u00f1o fijo y concatena cadenas para los especificadores de formato %s usando strcat() sin verificar la capacidad restante del b\u00fafer. Cuando se invoca printfUART con una cadena controlada por el llamador m\u00e1s larga que el espacio disponible, la secuencia sprintf/strcat sin l\u00edmites escribe m\u00e1s all\u00e1 del final de debugbuf, lo que resulta en corrupci\u00f3n de memoria global. Esto puede causar denegaci\u00f3n de servicio, comportamiento no deseado o revelaci\u00f3n de informaci\u00f3n a trav\u00e9s de un estado global adyacente corrupto o salida UART."}], "lastModified": "2026-06-17T10:19:33.490", "sourceIdentifier": "disclosure@vulncheck.com"}