Description
Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single node advertising a User.long_name that contains a malformed character encoding can render other radios unusable over BLE when managed through the iOS app. The malformed name does not need to be maliciously crafted — it can arise from ordinary buffer truncation and has been observed occurring naturally in the wild. At least one code path could place a null terminator in the middle of a multibyte sequence, leaving a malformed User.long_name in the node database. The problem surfaced downstream: the iOS app enforced encoding validation and therefore cannot parse a node database once it contains a poisoned entry. This caused BLE sync to enter a fail/retry loop, resulting in loss of control over the affected device. For a typical user managing their radio with the iOS app, the device becomes effectively unusable until the poisoned node ages out of the on-device database, or unless they have an alternate management path (e.g., the Python CLI, which can be used to identify and remove the offending entries manually). Because the malformed name propagates through the mesh, the temporary presence of a single affected node can degrade BLE management for iOS users across a wide geographical area for an extended period. Less technical users have no straightforward recovery path. Starting in version 2.7.23.b246bcd, the firmware has added input sanitization and regression tests demonstrating recovery for already-poisoned devices. The apps have also taken steps to ensure more graceful handling of malformed encoding sequences as well.
Published: 2026-07-19
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Meshtastic firmware before 2.7 advertising a User.long_name containing a malformed UTF‑8 sequence to corrupt the on‑device node database. The corrupted entry triggers a validation failure in the iOS app’s BLE sync routine, forcing the device into a fail‑retry loop and effectively stripping iOS the poisoned entry expires or is removed. The flaw is not limited to specially crafted payloads; ordinary buffer truncation can produce the same corruption. Recognized as CWE‑20, the weakness arises from insufficient input validation when storing broadcast data.

Affected Systems

The vulnerability affects Meshtastic firmware releases prior to version 2.7.23.b246bcd. Devices running those firmware versions on any platform that connects via the iOS app (and potentially other BLE‑based managers) are impacted. The issue is tied to the User.long_name field broadcast over LoRa.

Risk and Exploitability

The CVSS score of 7.5 indicates a high‑severity denial‑of‑service condition. The EPSS score is < 1 %, suggesting that exploitation is unexpectedly rare, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to be part of the mesh to inject a malformed name, meaning the attack vector is material broadcast over LoRa. Once the forged node joins the mesh, its poisoned entry propagates through any node that caches the database, extending the outage across the entire network until the stale data ages out or is repaired.

Generated by OpenCVE AI on July 30, 2026 at 19:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade all Meshtastic devices to firmware 2.7.23.b246bcd or later.
  • Install the latest version of the iOS app (and any other client) that includes graceful handling of malformed possible, use the Meshtastic Python CLI to locate and delete entries containing malformed User.long_name values from the node database.
  • Configure node long names to use valid UTF‑8 encoding and avoid truncation or non‑ASCII characters thatinterpreted.

Generated by OpenCVE AI on July 30, 2026 at 19:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 21 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 12:30:00 +0000

Type Values Removed Values Added
First Time appeared Meshtastic
Meshtastic firmware
Vendors & Products Meshtastic
Meshtastic firmware

Sun, 19 Jul 2026 23:45:00 +0000

Type Values Removed Values Added
Description Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single node advertising a User.long_name that contains a malformed character encoding can render other radios unusable over BLE when managed through the iOS app. The malformed name does not need to be maliciously crafted — it can arise from ordinary buffer truncation and has been observed occurring naturally in the wild. At least one code path could place a null terminator in the middle of a multibyte sequence, leaving a malformed User.long_name in the node database. The problem surfaced downstream: the iOS app enforced encoding validation and therefore cannot parse a node database once it contains a poisoned entry. This caused BLE sync to enter a fail/retry loop, resulting in loss of control over the affected device. For a typical user managing their radio with the iOS app, the device becomes effectively unusable until the poisoned node ages out of the on-device database, or unless they have an alternate management path (e.g., the Python CLI, which can be used to identify and remove the offending entries manually). Because the malformed name propagates through the mesh, the temporary presence of a single affected node can degrade BLE management for iOS users across a wide geographical area for an extended period. Less technical users have no straightforward recovery path. Starting in version 2.7.23.b246bcd, the firmware has added input sanitization and regression tests demonstrating recovery for already-poisoned devices. The apps have also taken steps to ensure more graceful handling of malformed encoding sequences as well.
Title Meshtastic: Malformed UTF-8 in User.long_name broadcast over LoRa causes mesh-wide client decode failure
Weaknesses CWE-20
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Meshtastic Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-21T14:53:42.856Z

Reserved: 2026-04-28T17:26:12.084Z

Link: CVE-2026-42566

cve-icon Vulnrichment

Updated: 2026-07-21T14:53:35.432Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T20:00:20Z

Weaknesses
  • CWE-20

    Improper Input Validation