CVE-2026-42566 is an improper input validation vulnerability (CWE-20) in Meshtastic firmware prior to version 2.7.23.b246bcd. A node advertising a User.long_name with malformed character encoding—arising from buffer truncation or similar issues—can poison the node database. The iOS app enforces encoding validation and cannot parse the poisoned database, causing BLE sync to fail and enter retry loops, effectively rendering devices unusable via BLE management on iOS. The malformed name propagates through the mesh network, impacting multiple users over a wide area. The vulnerability does not require malicious crafting of the name and has been observed naturally. Starting with version 2.7.23.b246bcd, input sanitization and regression tests have been added to the firmware, and the apps have improved robustness against malformed encoding sequences.

The vulnerability causes denial of service for iOS users managing Meshtastic radios via BLE, as the iOS app cannot parse the node database containing malformed User.long_name entries. This results in BLE sync fail/retry loops and loss of control over affected devices. The issue can propagate through the mesh network, degrading BLE management for multiple users across a wide geographical area for an extended time. Less technical users have no straightforward recovery method unless they use alternate management tools like the Python CLI. There is no impact on confidentiality or integrity, only availability (denial of service).

Firmware version 2.7.23.b246bcd and later include input sanitization to prevent malformed User.long_name entries and regression tests to recover already-poisoned devices. Users should upgrade to this version or later. The Meshtastic apps have also improved handling of malformed encoding sequences to reduce impact. If upgrading is not immediately possible, affected users can use alternate management paths such as the Python CLI to identify and remove malformed entries manually. Patch status is not explicitly confirmed in the advisory; users should verify with the vendor for the latest remediation guidance.