CVE-2026-42566 meshtastic CVE debrief

Who should care

Users managing their radio with the iOS app, particularly those with limited technical expertise, should be aware of this issue as it can render devices unusable until the affected node ages out of the on-device database or is manually removed.

Technical summary

The vulnerability arises from a single node advertising a User.long_name with malformed character encoding, which can occur naturally due to buffer truncation. This malformed name can propagate through the mesh, causing BLE sync to enter a fail/retry loop and resulting in loss of control over the affected device for iOS users across a wide geographical area. The issue is addressed in version 2.7.23.b246bcd with input sanitization and regression tests.

Defensive priority

High priority should be given to updating to version 2.7.23.b246bcd or later. Users should also be aware of the potential for affected nodes in their network and take steps to identify and remove them if necessary. It is recommended to monitor for signs of affected nodes in the network and have an alternate management path such as the Python CLI to identify and remove the offending entries manually.

Recommended defensive actions

• Update to version 2.7.23.b246bcd or later
• Identify and remove affected nodes manually using an alternate management path such as the Python CLI
• Monitor for signs of affected nodes in the network
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record was published on 2026-07-20T00:16:58.050Z and has not been modified since then. The NVD entry is currently 7.5 HIGH. Limited details are available about the vulnerability, but it is known to affect the Meshtastic open source mesh networking solution prior to version 2.7.23.b246bcd. The vulnerability arises from a single node advertising a User.long_name with malformed character encoding, which can occur naturally due to buffer truncation. This issue has been observed occurring naturally in the wild. The problem surfaced downstream: the iOS app enforced encoding validation and therefore cannot parse a node database once it contains a poisoned entry.

Official resources