CVE-2025-24797 is a critical buffer overflow (CVSS 9.4) in Meshtastic firmware, caused by mesh packets with invalid protobuf data, and it can lead to remote code execution without authentication. It is fixed in firmware 2.6.2. Update every node, since the attack works whenever a device rebroadcasts on the default channel.
What's affected
The NVD record names the Meshtastic firmware, and the advisory says the issue is fixed in 2.6.2. Firmware before 2.6.2 is the range to treat as affected.
The advisory describes the fault this way: a fault in the handling of mesh packets containing invalid protobuf data can cause an attacker controlled buffer overflow. That could let an attacker hijack execution flow and possibly run code. No authentication or user interaction is needed, as long as the target device rebroadcasts packets on the default channel.
The advisory also notes that the report followed a 90 day responsible disclosure timeline. The record is not on the CISA Known Exploited Vulnerabilities list.
The weaknesses are classed as CWE-119 (improper restriction of operations within the bounds of a memory buffer) and CWE-122 (heap-based buffer overflow). The score is 9.4 (CRITICAL). The vector, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H, reads as reachable over the network, low attack complexity, no privileges required and no user interaction. Impact is high on confidentiality, limited on integrity and high on availability. The record was published on 2025-04-15.
Meshtastic firmware 2.6.2 is the fixed version named in the record and the advisory. Flash it, or any later release, to every device you run.
How to check if you're exposed
Mesh networks have many small devices, so build a list first.
- Make a list of every Meshtastic node you own, including solar nodes on roofs and repeaters you set up and forgot.
- For each node, read the firmware version in the Meshtastic app or with the command line tool.
meshtastic --info
- Any firmware earlier than 2.6.2 is affected.
- Note which nodes use the default channel and which are set to rebroadcast, since the advisory ties the attack to rebroadcast on the default channel.
- For nodes in hard to reach places, plan a visit or an over the air update path before the next season of use.
What to do now
- Update every Meshtastic node to firmware 2.6.2 or later, starting with repeaters and those on the default channel.
- Keep a written list of node locations, hardware models and firmware versions so the next update is faster.
- If you cannot reach a node soon, consider switching it off or changing its role until it can be updated, and weigh the effect on your mesh.
- Review which devices rebroadcast on the default channel and whether they need to.
- Subscribe to the project's release announcements so you hear about the next fix quickly.
Why it matters
Buffer overflows, listed as CWE-119 and CWE-122, happen when code writes more data into a memory area than it can hold. Here the trigger is a packet with invalid protobuf data. Protobuf is a compact format, and parsing code has to cope with malformed input without trusting length fields that the sender controls. When it does not, memory gets overwritten, which in the worst case lets an attacker steer what the device runs.
This flaw earns a 9.4 because it needs no login and no user action, and mesh radios by design accept packets from anyone in range. Firmware on radio nodes also gets updated less often than software on servers, which makes the patch gap long. A tidy node list and a routine for flashing are what close it.
If you track many applications, the free in-browser dependency scan at gold.safeguard.sh/scan can show which of your components have known CVEs, and the Gold directory lists each one with its fix status.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which Meshtastic firmware fixes CVE-2025-24797?
Firmware 2.6.2, according to the record and the advisory. Use that or a later release.
Does the attack need an account or any action from the node owner?
No. The advisory says no authentication or user interaction is required, as long as the target device rebroadcasts packets on the default channel.
Sources
- Safeguard Gold entry for CVE-2025-24797
- NVD record data for CVE-2025-24797 (published 2025-04-15)
- Meshtastic security advisory GHSA-33hw-xhfh-944r
Last reviewed: 19 October 2026.
