CVE-2026-32706: falha de alta gravidade em PX4-Autopilot
PX4 autopilot has a global buffer overflow in crsf_rc via oversized variable-length known packet
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.3%
PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, The crsf_rc parser accepts an oversized variable-length known packet and copies it into a fixed 64-byte global buffer without a bounds check. In deployments where crsf_rc is enabled on a CRSF serial port, an adjacent/raw-serial attacker can trigger memory corruption and crash PX4. This vulnerability is fixed in 1.17.0-rc2.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Produtos afetados
PX4 · PX4-AutopilotCVEs relacionadas — PX4-Autopilot
No mesmo produto, das mais perigosas para as menos.
CVE-2023-46256MEDIUMPX4-Autopilot Heap Buffer Overflow BugEPSS 0.7%CVE-2023-47625LOWGlobal Buffer Overflow leading to denial of service in PX4-AutopilotEPSS 0.5%CVE-2026-102809HIGHPX4 Autopilot through 1.17.0 Stack Exhaustion via tests file2 CommandEPSS 0.5%CVE-2026-32709MEDIUMPX4 Autopilot MAVLink FTP Unauthenticated Path Traversal (Arbitrary File Read/Write/Delete)EPSS 0.5%CVE-2026-84698HIGHPX4 Autopilot sd_bench Heap Buffer Overflow via Block SizeEPSS 0.4%CVE-2026-86097HIGHPX4 Autopilot through 1.17.0 Null Pointer Dereference via param selectEPSS 0.4%