CVE-2026-32705

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32705", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-13T14:33:42.823Z", "datePublished": "2026-03-13T21:15:55.509Z", "dateUpdated": "2026-03-17T16:03:00.531Z"}, "containers": {"cna": {"title": "PX4 autopilot BST Device Name Length Can Overflow Driver Buffer", "problemTypes": [{"descriptions": [{"cweId": "CWE-121", "lang": "en", "description": "CWE-121: Stack-based Buffer Overflow", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-79mp-34pp-2f3f", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-79mp-34pp-2f3f"}], "affected": [{"vendor": "PX4", "product": "PX4-Autopilot", "versions": [{"version": "< 1.17.0-rc2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-13T21:15:55.509Z"}, "descriptions": [{"lang": "en", "value": "PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, the BST telemetry probe writes a string terminator using a device-provided length without bounds. A malicious BST device can report an oversized dev_name_len, causing a stack overflow in the driver and crashing the task (or enabling code execution). This vulnerability is fixed in 1.17.0-rc2."}], "source": {"advisory": "GHSA-79mp-34pp-2f3f", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-79mp-34pp-2f3f", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-17T16:02:26.401232Z", "id": "CVE-2026-32705", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-17T16:03:00.531Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32705", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-17T16:02:26.401232Z"}}}], "references": [{"url": "https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-79mp-34pp-2f3f", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-17T16:02:51.372Z"}}], "cna": {"title": "PX4 autopilot BST Device Name Length Can Overflow Driver Buffer", "source": {"advisory": "GHSA-79mp-34pp-2f3f", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "PX4", "product": "PX4-Autopilot", "versions": [{"status": "affected", "version": "< 1.17.0-rc2"}]}], "references": [{"url": "https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-79mp-34pp-2f3f", "name": "https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-79mp-34pp-2f3f", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, the BST telemetry probe writes a string terminator using a device-provided length without bounds. A malicious BST device can report an oversized dev_name_len, causing a stack overflow in the driver and crashing the task (or enabling code execution). This vulnerability is fixed in 1.17.0-rc2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121: Stack-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-13T21:15:55.509Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32705", "state": "PUBLISHED", "dateUpdated": "2026-03-17T16:03:00.531Z", "dateReserved": "2026-03-13T14:33:42.823Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-13T21:15:55.509Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "PX4-Autopilot", "vendor": "PX4", "versions": [{"status": "affected", "version": "< 1.17.0-rc2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dronecode:px4_drone_autopilot:*:*:*:*:*:*:*:*", "matchCriteriaId": "2FC2D6F1-D77D-44C2-A99C-55CB5A4474B9", "versionEndExcluding": "1.17.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:dronecode:px4_drone_autopilot:1.17.0:alpha1:*:*:*:*:*:*", "matchCriteriaId": "033A0A82-2986-44D5-A712-47B8D43407FF", "vulnerable": true}, {"criteria": "cpe:2.3:a:dronecode:px4_drone_autopilot:1.17.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "3F2EA96E-BC3A-42AB-B81B-53D5872B2296", "vulnerable": true}, {"criteria": "cpe:2.3:a:dronecode:px4_drone_autopilot:1.17.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "1EAC5320-8D94-477D-AB85-144F8218DDFB", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, the BST telemetry probe writes a string terminator using a device-provided length without bounds. A malicious BST device can report an oversized dev_name_len, causing a stack overflow in the driver and crashing the task (or enabling code execution). This vulnerability is fixed in 1.17.0-rc2."}, {"lang": "es", "value": "El piloto autom\u00e1tico PX4 es una soluci\u00f3n de control de vuelo para drones. Antes de la versi\u00f3n 1.17.0-rc2, la sonda de telemetr\u00eda BST escribe un terminador de cadena utilizando una longitud proporcionada por el dispositivo sin comprobaci\u00f3n de l\u00edmites. Un dispositivo BST malicioso puede informar un dev_name_len sobredimensionado, causando un desbordamiento de pila en el controlador y bloqueando la tarea (o permitiendo la ejecuci\u00f3n de c\u00f3digo). Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.17.0-rc2."}], "id": "CVE-2026-32705", "lastModified": "2026-06-17T10:36:14.460", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32705", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-17T16:02:26.401232Z", "version": "2.0.3"}}]}, "published": "2026-03-16T14:19:41.403", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-79mp-34pp-2f3f"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-79mp-34pp-2f3f"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.17.0-rc2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "PX4-Autopilot", "source": "cna", "vendor": "PX4"}, "product": "px4-autopilot", "vendor": "px4"}], "analysis": {"en": {"generated_at": "2026-03-16T23:04:12.327622+00:00", "value": {"mitigation_remediation": ["Upgrade PX4 Autopilot to version 1.17.0-rc2 or later", "If upgrade is not possible, restrict or disable BST telemetry from untrusted devices", "Verify that no malicious BST devices are connected"], "summary": {"action": "Upgrade ASAP", "impact": "Stack Buffer Overflow (potential code execution)"}, "threat_synthesis": {"affected_systems": "Devices running PX4 Autopilot versions earlier than 1.17.0\u2011rc2 are affected. This includes the 1.17.0\u2011alpha1, beta1, and rc1 releases as indicated by the CPEs. Any deployment of these releases that accepts BST telemetry from untrusted devices is vulnerable. Upgrading to 1.17.0\u2011rc2 or later resolves the issue.", "description_and_impact": "PX4 Autopilot, a flight control solution for drones, contains a stack-based buffer overflow in the BST telemetry probe. Prior to version 1.17.0\u2011rc2, the driver writes a string terminator using a device\u2011provided length without bounds. A malicious BST device that supplies an oversized dev_name_len can trigger a stack overflow, causing the task to crash or potentially enabling arbitrary code execution. This weakness is classified as CWE\u2011121 and is mitigated in 1.17.0\u2011rc2.", "risk_and_exploitability": "The CVSS score of 6.8 reflects a moderate to high severity, while an EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation yet. The attack vector, based on the description that a BST device can supply an oversized length, is inferred to be local device access or a device that can communicate with the autopilot. Due to the nature of the overflow, a successful exploit could lead to denial of service or remote code execution if the attacker can influence the device name field."}}}}, "created": "2026-03-16T09:22:46.314485+00:00", "updated": "2026-03-23T13:39:23.253389+00:00", "vendors": ["px4", "px4$PRODUCT$px4-autopilot"]}