CVE-2026-102808 describes a NULL pointer dereference vulnerability in PX4 Autopilot through version 1.17.0. The vulnerability exists in the sd_stress command where the -b byte count parameter is not validated before being passed to malloc() and memset(). This improper validation allows attackers with shell access, including through MAVLink protocol, to supply invalid byte count values that trigger a crash of the flight controller software.

Successful exploitation results in a denial of service by crashing the flight controller. This could disrupt flight operations relying on the PX4 Autopilot software. No evidence of privilege escalation or remote code execution is provided. The attack requires shell access or MAVLink access, which implies some level of prior access or control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict shell and MAVLink access to trusted users only to prevent exploitation. Monitor for vendor updates regarding an official fix.