CVE-2026-42566: CWE-20: Improper Input Validation in meshtastic firmware
Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single node advertising a User.long_name that contains a malformed character encoding can render other radios unusable over BLE when managed through the iOS app. The malformed name does not need to be maliciously crafted — it can arise from ordinary buffer truncation and has been observed occurring naturally in the wild. At least one code path could place a null terminator in the middle of a multibyte sequence, leaving a malformed User.long_name in the node database. The problem surfaced downstream: the iOS app enforced encoding validation and therefore cannot parse a node database once it contains a poisoned entry. This caused BLE sync to enter a fail/retry loop, resulting in loss of control over the affected device. For a typical user managing their radio with the iOS app, the device becomes effectively unusable until the poisoned node ages out of the on-device database, or unless they have an alternate management path (e.g., the Python CLI, which can be used to identify and remove the offending entries manually). Because the malformed name propagates through the mesh, the temporary presence of a single affected node can degrade BLE management for iOS users across a wide geographical area for an extended period. Less technical users have no straightforward recovery path. Starting in version 2.7.23.b246bcd, the firmware has added input sanitization and regression tests demonstrating recovery for already-poisoned devices. The apps have also taken steps to ensure more graceful handling of malformed encoding sequences as well.
AI Analysis
Technical Summary
CVE-2026-42566 is an improper input validation vulnerability (CWE-20) in Meshtastic firmware prior to version 2.7.23.b246bcd. A node advertising a User.long_name with malformed character encoding—arising from buffer truncation or naturally occurring—can corrupt the node database used by the iOS app. The app enforces encoding validation and fails to parse the poisoned database, causing BLE synchronization to enter a fail/retry loop and rendering the device unusable via BLE management. This malformed name can propagate through the mesh network, degrading BLE management for iOS users over a wide area. Recovery is difficult for less technical users without alternate management paths. The issue is fixed in version 2.7.23.b246bcd by adding input sanitization and regression tests, with app updates improving handling of malformed encoding.
Potential Impact
The vulnerability causes denial of service for iOS users managing Meshtastic devices over BLE by causing BLE sync failures and loss of control of affected radios. The malformed User.long_name can propagate through the mesh network, potentially impacting multiple devices and users across a wide geographical area. There is no direct confidentiality or integrity impact reported. The disruption lasts until the poisoned node entry ages out or is manually removed via alternate management tools. This can significantly degrade user experience and device manageability.
Mitigation Recommendations
A fix is available starting with Meshtastic firmware version 2.7.23.b246bcd, which includes input sanitization to prevent malformed User.long_name entries and regression tests for recovery. Users should upgrade to this version or later. The iOS app has also been updated to handle malformed encoding sequences more gracefully. Until upgrading, affected users can use alternate management tools such as the Python CLI to identify and remove poisoned entries manually. Patch status is not explicitly confirmed beyond the stated fixed version; users should consult the vendor advisory for the latest remediation guidance.
CVE-2026-42566: CWE-20: Improper Input Validation in meshtastic firmware
Description
Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single node advertising a User.long_name that contains a malformed character encoding can render other radios unusable over BLE when managed through the iOS app. The malformed name does not need to be maliciously crafted — it can arise from ordinary buffer truncation and has been observed occurring naturally in the wild. At least one code path could place a null terminator in the middle of a multibyte sequence, leaving a malformed User.long_name in the node database. The problem surfaced downstream: the iOS app enforced encoding validation and therefore cannot parse a node database once it contains a poisoned entry. This caused BLE sync to enter a fail/retry loop, resulting in loss of control over the affected device. For a typical user managing their radio with the iOS app, the device becomes effectively unusable until the poisoned node ages out of the on-device database, or unless they have an alternate management path (e.g., the Python CLI, which can be used to identify and remove the offending entries manually). Because the malformed name propagates through the mesh, the temporary presence of a single affected node can degrade BLE management for iOS users across a wide geographical area for an extended period. Less technical users have no straightforward recovery path. Starting in version 2.7.23.b246bcd, the firmware has added input sanitization and regression tests demonstrating recovery for already-poisoned devices. The apps have also taken steps to ensure more graceful handling of malformed encoding sequences as well.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-42566 is an improper input validation vulnerability (CWE-20) in Meshtastic firmware prior to version 2.7.23.b246bcd. A node advertising a User.long_name with malformed character encoding—arising from buffer truncation or naturally occurring—can corrupt the node database used by the iOS app. The app enforces encoding validation and fails to parse the poisoned database, causing BLE synchronization to enter a fail/retry loop and rendering the device unusable via BLE management. This malformed name can propagate through the mesh network, degrading BLE management for iOS users over a wide area. Recovery is difficult for less technical users without alternate management paths. The issue is fixed in version 2.7.23.b246bcd by adding input sanitization and regression tests, with app updates improving handling of malformed encoding.
Potential Impact
The vulnerability causes denial of service for iOS users managing Meshtastic devices over BLE by causing BLE sync failures and loss of control of affected radios. The malformed User.long_name can propagate through the mesh network, potentially impacting multiple devices and users across a wide geographical area. There is no direct confidentiality or integrity impact reported. The disruption lasts until the poisoned node entry ages out or is manually removed via alternate management tools. This can significantly degrade user experience and device manageability.
Mitigation Recommendations
A fix is available starting with Meshtastic firmware version 2.7.23.b246bcd, which includes input sanitization to prevent malformed User.long_name entries and regression tests for recovery. Users should upgrade to this version or later. The iOS app has also been updated to handle malformed encoding sequences more gracefully. Until upgrading, affected users can use alternate management tools such as the Python CLI to identify and remove poisoned entries manually. Patch status is not explicitly confirmed beyond the stated fixed version; users should consult the vendor advisory for the latest remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-28T17:26:12.084Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5d60df2a4a8d5989626f51
Added to database: 07/19/2026, 23:42:23 UTC
Last enriched: 07/19/2026, 23:56:40 UTC
Last updated: 07/20/2026, 20:47:02 UTC
Views: 54
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.