Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 8

Export CSV
CVE-2026-102808

PX4 Autopilot through 1.17.0 NULL Pointer Dereference via sd_stress

PX4 Autopilot through 1.17.0 contains a NULL pointer dereference vulnerability in the sd_stress command where the -b byte count parameter is parsed without validation before being passed to malloc() and memset(). Attackers with shell access, including through MAVLink, can supply invalid byte count values to crash the flight controller.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Px4
Products
Autopilot
CVE-2026-102809

PX4 Autopilot through 1.17.0 Stack Exhaustion via tests file2 Command

PX4 Autopilot through 1.17.0 contains an uncontrolled stack allocation vulnerability in the file2 test command that fails to validate the write chunk size parameter. Attackers with shell access can supply an excessively large value to the -c option to trigger stack overflow and crash the flight controller.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Px4
Products
Autopilot
CVE-2026-86714

PX4 Autopilot through 1.17.0 Stack Buffer Over-read via netman

PX4 Autopilot through 1.17.0 contains a stack buffer over-read vulnerability in the netman system command that fails to validate interface name length. Attackers can supply interface names of 74 bytes or more via the -i option to read beyond buffer boundaries, leaking stack memory to console output or writing it into persistent network configuration files.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Px4
Products
Autopilot
CVE-2026-86096

PX4 Autopilot through 1.17.0 Use-After-Free via Temperature Calibration Task Startup

PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start() due to a race condition between task spawning and object deletion. Attackers can trigger the calibration process via shell commands to write to freed heap memory, corrupting unrelated objects or allocator metadata and destabilizing heap operations.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Px4
Products
Autopilot
CVE-2026-86097

PX4 Autopilot through 1.17.0 Null Pointer Dereference via param select

PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in param_set_default_file() and param_set_backup_file() functions that allows attackers to crash the autopilot process. Attackers can invoke 'param select' or 'param select-backup' commands with no path argument from any PX4 shell to trigger the crash.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Px4
Products
Autopilot
CVE-2026-86713

PX4 Autopilot through 1.17.0 Use-After-Free in load_mon

PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the load_mon module's stop path where exit_and_cleanup() deletes the LoadMon object and frees the performance counter before perf_end() attempts to access it. Attackers can trigger this vulnerability by issuing the load_mon stop command from any PXH or MAVLink shell, causing reads and writes through freed memory that corrupt heap objects and destabilize the flight stack.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Px4
Products
Autopilot
CVE-2026-84698

PX4 Autopilot sd_bench Heap Buffer Overflow via Block Size

PX4 Autopilot contains a heap buffer overflow vulnerability in the sd_bench command that writes a four-byte block number into a user-supplied sized allocation. Attackers can invoke sd_bench with a block size below four bytes to overflow the heap buffer and potentially execute code or crash the system.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Px4
Products
Autopilot
CVE-2026-1579

PX4 Autopilot Missing authentication for critical function

The MAVLink communication protocol does not require cryptographic authentication by default. When MAVLink 2.0 message signing is not enabled, any message -- including SERIAL_CONTROL, which provides interactive shell access -- can be sent by an unauthenticated party with access to the MAVLink interface. PX4 provides MAVLink 2.0 message signing as the cryptographic authentication mechanism for all MAVLink communication. When signing is enabled, unsigned messages are rejected at the protocol level.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Px4
Products
Autopilot Px4-autopilot