Executive brief
Meshtastic is an open-source mesh networking platform used for long-range communication. A vulnerability in how the system handles user names allows a single device to broadcast a malformed name that crashes the iOS management app for other users on the network. This can make radios unusable for anyone using an iPhone to manage their device until the bad data is manually cleared or expires.
Technical details
A vulnerability exists in Meshtastic firmware prior to version 2.7.23.b246bcd due to improper input validation (CWE-20) of the User.long_name field. A code path involving buffer truncation can place a null terminator in the middle of a multibyte UTF-8 sequence, creating malformed encoding. When this malformed name is broadcast over the mesh and stored in the node database, the iOS app's strict encoding validation fails, causing the Bluetooth Low Energy (BLE) sync process to enter an infinite fail/retry loop. This results in a denial-of-service for iOS-based management. The issue can be triggered remotely without authentication and propagates across the mesh network. Fixes include firmware-level input sanitization and improved error handling in the mobile applications.
Affected products
- Meshtastic firmware < 2.7.23.b246bcd
Timeline
- 2026-07-09: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: CVE published to NVD