Mmeshtastic

Products

Exploited and recent CVEs

• CVE-2026-42566 High 7.5 Meshtastic: Malformed UTF-8 in User.long_name broadcast over LoRa causes mesh-wide client decode failure 0.5%
• CVE-2026-44359 Critical 10.0 Meshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target Fork Checkout in CI Workflow 1.8%
• CVE-2025-55292 High 8.2 In Meshtastic, an attacker can spoof licensed amateur flag for a node 0.1%
• CVE-2025-53627 Medium 5.3 Meshtastic firmware allows forged DMs with no PKC to show up as encrypted 0.2%
• CVE-2025-55293 Critical 9.4 Meshtastic allows crafting of specific NodeInfo packets that overwrite any publicKey saved in the NodeDB 0.5%
• CVE-2024-47065 Low 2.7 Traceroute_APP responses are not rate-limited. 0.3%
• CVE-2025-53637 Medium 4.1 Meshtastic allows Command Injection in GitHub Action 0.4%
• CVE-2025-24798 Medium 4.3 Meshtastic crashes via an unimplemented routing module reply 0.4%
• CVE-2025-52883 Medium 5.3 Meshtastic-Android vulnerable to forged DMs with no PKC showing up as encrypted 0.3%
• CVE-2025-52464 Critical 9.5 Meshtastic Repeated Public and Private Keypairs 0.6%
• CVE-2025-24797 Critical 9.4 Meshtastic incorrectly hands malformed packets leads to controlled buffer overflow 0.9%
• CVE-2025-21608 Medium 5.3 Forged packets over MQTT can show up in direct messages in Meshtastic firmware 0.4%
• CVE-2024-51500 Medium 5.3 Failure to check for packets from the broadcast address allows potential DDoS amplification attack in Meshtastic firmware 0.4%
• CVE-2024-47079 Medium 6.4 Unauthorized usage of remote hardware module because of missing channel verification 0.2%
• CVE-2024-47078 High 8.1 Meshtastic firmware Authentication/Authorization Bypass via MQTT 0.5%
• CVE-2024-45038 High 7.5 Device crash via malformed MQTT packet when downlink is enabled in Meshtastic device firmware 0.6%