CVE-2026-86714: Out-of-bounds Read in PX4 PX4-Autopilot

CVE-2026-86714 describes a stack buffer over-read in PX4 Autopilot through version 1.17.0. The vulnerability exists in the netman system command where the interface name length is not validated. Attackers can exploit this by providing interface names of 74 bytes or more via the -i option, causing the system to read beyond the intended buffer boundaries. This results in leakage of stack memory either to the console output or into persistent network configuration files.

The vulnerability allows an attacker to read memory beyond the allocated buffer on the stack, which can lead to leakage of sensitive stack memory contents. This could expose information that may aid further attacks or reconnaissance. There is no indication of privilege escalation or code execution. The CVSS 4.0 score is 5.3 (medium severity), reflecting the limited scope and impact of the information disclosure.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid supplying interface names of 74 bytes or more to the netman system command's -i option to prevent triggering the vulnerability.