Threat Intelligence Database

PX4 Autopilot through 1.17.0 contains an uncontrolled stack allocation vulnerability in the file2 test command that fails to validate the write chunk size parameter. Attackers with shell access can supply an excessively large value to the -c option to trigger stack overflow and crash the flight controller.

PX4 Autopilot versions up to 1.17.0 have a NULL pointer dereference vulnerability in the sd_stress command. This occurs because the -b byte count parameter is not validated before being used in memory allocation functions. An attacker with shell access, including via MAVLink, can supply invalid values to cause the flight controller to crash. The vulnerability has a high severity score of 7.1. No patch or remediation details are provided in the available data.

PX4 Autopilot through 1.17.0 contains a stack buffer over-read vulnerability in the netman system command that fails to validate interface name length. Attackers can supply interface names of 74 bytes or more via the -i option to read beyond buffer boundaries, leaking stack memory to console output or writing it into persistent network configuration files.

PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the load_mon module's stop path where exit_and_cleanup() deletes the LoadMon object and frees the performance counter before perf_end() attempts to access it. Attackers can trigger this vulnerability by issuing the load_mon stop command from any PXH or MAVLink shell, causing reads and writes through freed memory that corrupt heap objects and destabilize the flight stack.

PX4 Autopilot versions up to 1.17.0 contain a null pointer dereference vulnerability in the param_set_default_file() and param_set_backup_file() functions. This flaw can be triggered by invoking 'param select' or 'param select-backup' commands without a path argument from any PX4 shell, causing the autopilot process to crash. The vulnerability has a high severity score of 7.1 and does not require privileges or user interaction to exploit.

PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start() due to a race condition between task spawning and object deletion. Attackers can trigger the calibration process via shell commands to write to freed heap memory, corrupting unrelated objects or allocator metadata and destabilizing heap operations.

PX4 Autopilot contains a heap buffer overflow vulnerability in the sd_bench command that writes a four-byte block number into a user-supplied sized allocation. Attackers can invoke sd_bench with a block size below four bytes to overflow the heap buffer and potentially execute code or crash the system.

CVE-2026-32743 is a stack-based buffer overflow vulnerability in PX4-Autopilot versions 1.17.0-rc2 and earlier. The flaw exists in the MavlinkLogHandler component, where a fixed 60-byte buffer is overflowed due to unbounded sscanf parsing of file paths. An attacker with MAVLink link access can exploit this by creating deeply nested directories via MAVLink FTP and then requesting the log list, causing the flight controller's MAVLink task to crash. This results in denial of service by loss of telemetry and command capabilities. The vulnerability does not impact confidentiality or integrity but severely affects availability. No authentication or user interaction is required to trigger the issue. The vulnerability has a CVSS score of 6.5 (medium severity) and has been fixed in a recent commit.

MediumVulnerabilityUnited StatesChinaGermany+7#cve#cve-2026-32743#cwe-121

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc1, a heap-use-after-free is detected in the MavlinkShell::available() function. The issue is caused by a race condition between the MAVLink receiver thread (which handles shell creation/destruction) and the telemetry sender thread (which polls the shell for available output). The issue is remotely triggerable via MAVLink SERIAL_CONTROL messages (ID 126), which can be sent by an external ground station or automated script. This vulnerability is fixed in 1.17.0-rc1.

MediumVulnerabilityUnited StatesChinaGermany+7#cve#cve-2026-32724#cwe-416

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, A logic error in the PX4 Autopilot MAVLink FTP session validation uses incorrect boolean logic (&& instead of ||), allowing BurstReadFile and WriteFile operations to proceed with invalid sessions or closed file descriptors. This enables an unauthenticated attacker to put the FTP subsystem into an inconsistent state, trigger operations on invalid file descriptors, and bypass session isolation checks. This vulnerability is fixed in 1.17.0-rc2.

MediumVulnerabilityUnited StatesChinaGermany+7#cve#cve-2026-32713#cwe-670