Vulnerability · Published Apr 14, 2025 · Assigned by GitHub_M

CVE-2025-24797Meshtastic incorrectly hands malformed packets leads to controlled buffer overflow

Critical 9.4

In plain English

A critical-severity memory corruption in firmware from meshtastic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)9.4Critical

Exploit odds (30 days)0.9%top 40.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Meshtastic is an open source mesh networking solution. A fault in the handling of mesh packets containing invalid protobuf data can result in an attacker-controlled buffer overflow, allowing an attacker to hijack execution flow, potentially resulting in remote code execution. This attack does not require authentication or user interaction, as long as the target device rebroadcasts packets on the default channel. This vulnerability fixed in 2.6.2.

Affected products (as reported)

Vendor	Product	Versions
meshtastic	firmware	< 2.6.2

Weakness: CWE-119, CWE-122 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

References

https://github.com/meshtastic/firmware/security/advisories/GHSA-33hw-xhfh-944r x_refsource_CONFIRM