CVE-2026-42566

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42566", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-28T17:26:12.084Z", "datePublished": "2026-07-19T23:16:04.835Z", "dateUpdated": "2026-07-21T14:53:42.856Z"}, "containers": {"cna": {"title": "Meshtastic: Malformed UTF-8 in User.long_name broadcast over LoRa causes mesh-wide client decode failure", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/meshtastic/firmware/security/advisories/GHSA-7ph5-2mjv-69h8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/meshtastic/firmware/security/advisories/GHSA-7ph5-2mjv-69h8"}, {"name": "https://github.com/meshtastic/firmware/commit/2cc13a1132d94b66a9505e7f07ee2d3e83bd0c95", "tags": ["x_refsource_MISC"], "url": "https://github.com/meshtastic/firmware/commit/2cc13a1132d94b66a9505e7f07ee2d3e83bd0c95"}], "affected": [{"vendor": "meshtastic", "product": "firmware", "versions": [{"version": "< 2.7.23.b246bcd", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-19T23:16:04.835Z"}, "descriptions": [{"lang": "en", "value": "Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single node advertising a User.long_name that contains a malformed character encoding can render other radios unusable over BLE when managed through the iOS app. The malformed name does not need to be maliciously crafted \u2014 it can arise from ordinary buffer truncation and has been observed occurring naturally in the wild. At least one code path could place a null terminator in the middle of a multibyte sequence, leaving a malformed User.long_name in the node database. The problem surfaced downstream: the iOS app enforced encoding validation and therefore cannot parse a node database once it contains a poisoned entry. This caused BLE sync to enter a fail/retry loop, resulting in loss of control over the affected device. For a typical user managing their radio with the iOS app, the device becomes effectively unusable until the poisoned node ages out of the on-device database, or unless they have an alternate management path (e.g., the Python CLI, which can be used to identify and remove the offending entries manually). Because the malformed name propagates through the mesh, the temporary presence of a single affected node can degrade BLE management for iOS users across a wide geographical area for an extended period. Less technical users have no straightforward recovery path. Starting in version 2.7.23.b246bcd, the firmware has added input sanitization and regression tests demonstrating recovery for already-poisoned devices. The apps have also taken steps to ensure more graceful handling of malformed encoding sequences as well."}], "source": {"advisory": "GHSA-7ph5-2mjv-69h8", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-21T14:53:28.643598Z", "id": "CVE-2026-42566", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-21T14:53:42.856Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42566", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-21T14:53:28.643598Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-21T14:53:35.432Z"}}], "cna": {"title": "Meshtastic: Malformed UTF-8 in User.long_name broadcast over LoRa causes mesh-wide client decode failure", "source": {"advisory": "GHSA-7ph5-2mjv-69h8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "meshtastic", "product": "firmware", "versions": [{"status": "affected", "version": "< 2.7.23.b246bcd"}]}], "references": [{"url": "https://github.com/meshtastic/firmware/security/advisories/GHSA-7ph5-2mjv-69h8", "name": "https://github.com/meshtastic/firmware/security/advisories/GHSA-7ph5-2mjv-69h8", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/meshtastic/firmware/commit/2cc13a1132d94b66a9505e7f07ee2d3e83bd0c95", "name": "https://github.com/meshtastic/firmware/commit/2cc13a1132d94b66a9505e7f07ee2d3e83bd0c95", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single node advertising a User.long_name that contains a malformed character encoding can render other radios unusable over BLE when managed through the iOS app. The malformed name does not need to be maliciously crafted \u2014 it can arise from ordinary buffer truncation and has been observed occurring naturally in the wild. At least one code path could place a null terminator in the middle of a multibyte sequence, leaving a malformed User.long_name in the node database. The problem surfaced downstream: the iOS app enforced encoding validation and therefore cannot parse a node database once it contains a poisoned entry. This caused BLE sync to enter a fail/retry loop, resulting in loss of control over the affected device. For a typical user managing their radio with the iOS app, the device becomes effectively unusable until the poisoned node ages out of the on-device database, or unless they have an alternate management path (e.g., the Python CLI, which can be used to identify and remove the offending entries manually). Because the malformed name propagates through the mesh, the temporary presence of a single affected node can degrade BLE management for iOS users across a wide geographical area for an extended period. Less technical users have no straightforward recovery path. Starting in version 2.7.23.b246bcd, the firmware has added input sanitization and regression tests demonstrating recovery for already-poisoned devices. The apps have also taken steps to ensure more graceful handling of malformed encoding sequences as well."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-19T23:16:04.835Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42566", "state": "PUBLISHED", "dateUpdated": "2026-07-21T14:53:42.856Z", "dateReserved": "2026-04-28T17:26:12.084Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-19T23:16:04.835Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "firmware", "vendor": "meshtastic", "versions": [{"status": "affected", "version": "< 2.7.23.b246bcd"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:meshtastic:meshtastic_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "2040D50F-8708-4B64-8D94-6BCDE3FD6D9A", "versionEndIncluding": "2.7.22", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single node advertising a User.long_name that contains a malformed character encoding can render other radios unusable over BLE when managed through the iOS app. The malformed name does not need to be maliciously crafted \u2014 it can arise from ordinary buffer truncation and has been observed occurring naturally in the wild. At least one code path could place a null terminator in the middle of a multibyte sequence, leaving a malformed User.long_name in the node database. The problem surfaced downstream: the iOS app enforced encoding validation and therefore cannot parse a node database once it contains a poisoned entry. This caused BLE sync to enter a fail/retry loop, resulting in loss of control over the affected device. For a typical user managing their radio with the iOS app, the device becomes effectively unusable until the poisoned node ages out of the on-device database, or unless they have an alternate management path (e.g., the Python CLI, which can be used to identify and remove the offending entries manually). Because the malformed name propagates through the mesh, the temporary presence of a single affected node can degrade BLE management for iOS users across a wide geographical area for an extended period. Less technical users have no straightforward recovery path. Starting in version 2.7.23.b246bcd, the firmware has added input sanitization and regression tests demonstrating recovery for already-poisoned devices. The apps have also taken steps to ensure more graceful handling of malformed encoding sequences as well."}, {"lang": "es", "value": "Meshtastic es una soluci\u00f3n de red mallada de c\u00f3digo abierto. Antes de la versi\u00f3n 2.7.23.b246bcd, un solo nodo que anuncia un User.long_name que contiene una codificaci\u00f3n de caracteres malformada puede dejar otras radios inutilizables a trav\u00e9s de BLE cuando se gestionan a trav\u00e9s de la aplicaci\u00f3n de iOS. El nombre malformado no necesita ser creado maliciosamente - puede surgir de una truncaci\u00f3n de b\u00fafer ordinaria y se ha observado que ocurre de forma natural en el entorno real. Al menos una ruta de c\u00f3digo podr\u00eda colocar un terminador nulo en medio de una secuencia multibyte, dejando un User.long_name malformado en la base de datos del nodo. El problema surgi\u00f3 en la parte descendente: la aplicaci\u00f3n de iOS aplicaba la validaci\u00f3n de codificaci\u00f3n y, por lo tanto, no puede analizar una base de datos de nodos una vez que contiene una entrada envenenada. Esto hizo que la sincronizaci\u00f3n BLE entrara en un bucle de fallo/reintento, lo que result\u00f3 en la p\u00e9rdida de control sobre el dispositivo afectado. Para un usuario t\u00edpico que gestiona su radio con la aplicaci\u00f3n de iOS, el dispositivo se vuelve efectivamente inutilizable hasta que el nodo envenenado caduque de la base de datos del dispositivo, o a menos que tengan una ruta de gesti\u00f3n alternativa (por ejemplo, la CLI de Python, que se puede usar para identificar y eliminar las entradas ofensivas manualmente). Debido a que el nombre malformado se propaga a trav\u00e9s de la malla, la presencia temporal de un solo nodo afectado puede degradar la gesti\u00f3n BLE para los usuarios de iOS en una amplia \u00e1rea geogr\u00e1fica durante un per\u00edodo prolongado. Los usuarios menos t\u00e9cnicos no tienen una ruta de recuperaci\u00f3n sencilla. A partir de la versi\u00f3n 2.7.23.b246bcd, el firmware ha a\u00f1adido saneamiento de entrada y pruebas de regresi\u00f3n que demuestran la recuperaci\u00f3n para dispositivos ya envenenados. Las aplicaciones tambi\u00e9n han tomado medidas para asegurar un manejo m\u00e1s robusto de las secuencias de codificaci\u00f3n malformadas tambi\u00e9n."}], "id": "CVE-2026-42566", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42566", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-21T14:53:28.643598Z", "version": "2.0.3"}}]}, "published": "2026-07-20T00:16:58.050", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/meshtastic/firmware/commit/2cc13a1132d94b66a9505e7f07ee2d3e83bd0c95"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/meshtastic/firmware/security/advisories/GHSA-7ph5-2mjv-69h8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.7.23.b246bcd)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "firmware", "source": "cna", "vendor": "meshtastic"}, "product": "firmware", "vendor": "meshtastic"}], "created": "2026-07-21T12:15:02.681893+00:00", "updated": "2026-07-30T20:00:20.062787+00:00", "vendors": ["meshtastic", "meshtastic$PRODUCT$firmware"]}