CVE-2026-86714 is a stack buffer over-read vulnerability in PX4-Autopilot through version 1.17.0. The issue occurs in the netman system command where the length of the interface name supplied via the -i option is not properly validated. Interface names of 74 bytes or longer cause the program to read beyond the allocated buffer, resulting in leakage of stack memory either to the console output or into persistent network configuration files. This vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity, with an attack vector of adjacent network and no required privileges or user interaction.

The vulnerability allows an attacker to read beyond the intended buffer boundaries, potentially leaking sensitive stack memory contents. This information leakage could expose internal memory data to an attacker via console output or persistent configuration files. However, the vulnerability does not allow code execution or privilege escalation. The CVSS score of 5.3 reflects a medium impact primarily due to information disclosure.

No official patch or remediation level has been published yet. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid supplying interface names of 74 bytes or more to the netman system command's -i option to prevent triggering the vulnerability.