CVE-2025-24797 Meshtastic incorrectly hands malformed packets leads to controlled buffer overflow
An attacker can achieve remote code execution on Meshtastic devices by sending malformed mesh packets that trigger a buffer overflow.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-24797?
CVE-2025-24797 is a critical memory corruption vulnerability in meshtastic firmware, published on 14 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Meshtastic is an open source mesh networking solution. A fault in the handling of mesh packets containing invalid protobuf data can result in an attacker-controlled buffer overflow, allowing an attacker to hijack execution flow, potentially resulting in remote code execution. This attack does not require authentication or user interaction, as long as the target device rebroadcasts packets on the default channel. This vulnerability fixed in 2.6.2.
Which versions are affected by CVE-2025-24797?
It affects 1 product.
Products include Meshtastic Meshtastic Firmware.
How do I fix CVE-2025-24797?
No fix has been published for CVE-2025-24797 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-24797 being exploited?
There is no known exploitation of CVE-2025-24797 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in meshtastic firmware
- CVE-2025-52464 Meshtastic Repeated Public and Private Keypairs
- CVE-2025-55293 Meshtastic allows crafting of specific NodeInfo packets that overwrite any publicKey saved in the NodeDB
- CVE-2025-55292 In Meshtastic, an attacker can spoof licensed amateur flag for a node
- CVE-2024-47078 Meshtastic firmware Authentication/Authorization Bypass via MQTT
- CVE-2026-42566 Meshtastic: Malformed UTF-8 in User.long_name broadcast over LoRa causes mesh-wide client decode failure
Sources
Also known as GHSA-33hw-xhfh-944r.