Meshtastic CVE-2026-42566

Triggering requires (1) a node in the mesh whose User.long_name (or short_name) contains a malformed/truncated multibyte UTF-8 sequence, which can occur naturally via buffer truncation, and (2) a victim radio running firmware prior to 2.7.23.b246bcd that ingests that name into its NodeDB, AND (3) the victim managing that radio through the Meshtastic iOS app, which is the client that enforces strict UTF-8 validation and refuses to parse the poisoned database. Limiting factors: the disruptive effect is specific to the iOS management path - Android, web, and Python CLI clients handle the malformed data more gracefully and are not locked out, so non-iOS-managed devices are not rendered unusable; the impact is availability of management only, with no code execution or data exposure; and recovery is possible without a patch by manually removing the entry via CLI or letting it age out.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5, HIGH) is consistent with a pure availability impact: no confidentiality or integrity loss, but the affected device becomes effectively unmanageable via the iOS app. Notably the vulnerability is triggerable without malice - the description states poisoned names 'arise from ordinary buffer truncation and has been observed occurring naturally in the wild' - so the practical likelihood of encountering the condition is higher than typical for a bug requiring a crafted payload, even though this is NOT confirmed active adversarial exploitation and there is no CISA KEV listing, no EPSS score provided, and no POC. The SSVC-style read is: technical impact is limited to availability of management, exploitation is low-effort/automatable in the sense that any propagating node can cause it, but there is no code execution or data exposure. One data discrepancy to flag: the intelligence tag 'Information Disclosure' contradicts the CVSS vector (C:N I:N A:H) - this is an availability/DoS issue, not information disclosure, so the tag appears mislabeled and should not drive triage. Real priority is moderate: disruptive and self-spreading for iOS-managed fleets, but non-destructive and recoverable.

A node on the mesh advertises a User.long_name in which a multibyte UTF-8 character has been truncated mid-sequence - from a normal name entry or buffer truncation, not necessarily malicious. The malformed name gossips across the LoRa mesh into the NodeDB of surrounding radios, and any user managing an affected radio with the Meshtastic iOS app finds BLE sync stuck in a fail/retry loop, losing control of the device until the entry is removed via the Python CLI or ages out. No public exploit code is required or identified, since ordinary truncation reproduces the condition.