PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, the BST telemetry probe writes a string terminator using a device-provided length without bounds. A malicious BST device can report an oversized dev_name_len, causing a stack overflow in the driver and crashing the task (or enabling code execution). This vulnerability is fixed in 1.17.0-rc2.
References
| Link | Resource |
|---|---|
| https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-79mp-34pp-2f3f | Exploit Vendor Advisory |
| https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-79mp-34pp-2f3f | Exploit Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
17 Mar 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-79mp-34pp-2f3f - Exploit, Vendor Advisory |
16 Mar 2026, 20:09
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:dronecode:px4_drone_autopilot:1.17.0:rc1:*:*:*:*:*:* cpe:2.3:a:dronecode:px4_drone_autopilot:1.17.0:alpha1:*:*:*:*:*:* cpe:2.3:a:dronecode:px4_drone_autopilot:1.17.0:beta1:*:*:*:*:*:* cpe:2.3:a:dronecode:px4_drone_autopilot:*:*:*:*:*:*:*:* |
|
| References | () https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-79mp-34pp-2f3f - Exploit, Vendor Advisory | |
| First Time |
Dronecode
Dronecode px4 Drone Autopilot |
16 Mar 2026, 14:19
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-16 14:19
Updated : 2026-03-17 17:16
NVD link : CVE-2026-32705
Mitre link : CVE-2026-32705
CVE.ORG link : CVE-2026-32705
JSON object : View
Products Affected
dronecode
- px4_drone_autopilot
CWE
CWE-121
Stack-based Buffer Overflow