{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-02T05:16:49.132","vulnerabilities":[{"cve":{"id":"CVE-2026-22211","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-01-14T16:15:56.950","lastModified":"2026-07-14T16:16:49.113","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"TinyOS versions up to and including 2.1.2 contain a global buffer overflow vulnerability in the printfUART formatted output implementation used within the ZigBee / IEEE 802.15.4 networking stack. The implementation formats output into a fixed-size global buffer and concatenates strings for %s format specifiers using strcat() without verifying remaining buffer capacity. When printfUART is invoked with a caller-controlled string longer than the available space, the unbounded sprintf/strcat sequence writes past the end of debugbuf, resulting in global memory corruption. This can cause denial of service, unintended behavior, or information disclosure via corrupted adjacent global state or UART output."},{"lang":"es","value":"Las versiones de TinyOS hasta la 2.1.2 inclusive contienen una vulnerabilidad de desbordamiento de búfer global en la implementación de salida formateada printfUART utilizada dentro de la pila de red ZigBee / IEEE 802.15.4. La implementación formatea la salida en un búfer global de tamaño fijo y concatena cadenas para los especificadores de formato %s usando strcat() sin verificar la capacidad restante del búfer. Cuando se invoca printfUART con una cadena controlada por el llamador más larga que el espacio disponible, la secuencia sprintf/strcat sin límites escribe más allá del final de debugbuf, lo que resulta en corrupción de memoria global. Esto puede causar denegación de servicio, comportamiento no deseado o revelación de información a través de un estado global adyacente corrupto o salida UART."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"TinyOS","product":"TinyOS","defaultStatus":"unknown","repo":"https://github.com/tinyos/tinyos-main","packageURL":"pkg:github/tinyos/tinyos-main","versions":[{"version":"0","lessThanOrEqual":"2.1.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-01-14T15:34:04.191428Z","id":"CVE-2026-22211","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/tinyos/tinyos-main","source":"disclosure@vulncheck.com"},{"url":"https://seclists.org/fulldisclosure/2026/Jan/14","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/tinyos-global-buffer-overflow-in-printfuart","source":"disclosure@vulncheck.com"}]}}]}