CVE-2026-22211

Katalog CVE

CVSS 5.1 · Medium EPSS 0,18%

Kerentanan Out-of-bounds Write. Skor CVSS 4.0 5.1 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

TinyOS versions up to and including 2.1.2 contain a global buffer overflow vulnerability in the printfUART formatted output implementation used within the ZigBee / IEEE 802.15.4 networking stack. The implementation formats output into a fixed-size global buffer and concatenates strings for %s format specifiers using strcat() without verifying remaining buffer capacity. When printfUART is invoked with a caller-controlled string longer than the available space, the unbounded sprintf/strcat sequence writes past the end of debugbuf, resulting in global memory corruption. This can cause denial of service, unintended behavior, or information disclosure via corrupted adjacent global state or UART output.

Rincian

Terbit di NVD

14 Januari 2026

Terakhir diubah

14 Juli 2026

Status NVD

Deferred

CVSS 4.0

5.1 (Medium), sumber vulncheck.com
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 6,4% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/tinyos/tinyos-main
• https://seclists.org/fulldisclosure/2026/Jan/14
• https://www.vulncheck.com/advisories/tinyos-global-buffer-overflow-in-printfuart