CVE-2026-102809
PX4 Autopilot through 1.17.0 Stack Exhaustion via tests file2 Command
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
PX4 Autopilot through 1.17.0 contains an uncontrolled stack allocation vulnerability in the file2 test command that fails to validate the write chunk size parameter. Attackers with shell access can supply an excessively large value to the -c option to trigger stack overflow and crash the flight controller.
| CWE | CWE-789 |
| Vendor | px4 |
| Product | px4-autopilot |
| Published | Sep 29, 2026 |
| Last Updated | Sep 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for px4 px4-autopilot
Be the first to know when new medium vulnerabilities affecting px4 px4-autopilot are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
PX4 / PX4-Autopilot
0 ≤ 1.17.0
References
github.com: https://github.com/PX4/PX4-Autopilot/pull/28586 github.com: https://github.com/PX4/PX4-Autopilot/commit/46a77d8ad15e7929ef261c41083dffd1bbfa9f85 github.com: https://github.com/PX4/PX4-Autopilot/blob/d6f12ad1c4f70ad3230afd7d86e971421e02fef4/src/systemcmds/tests/test_file2.c#L86-L130 github.com: https://github.com/PX4/PX4-Autopilot vulncheck.com: https://www.vulncheck.com/advisories/px4-autopilot-through-1.17.0-stack-exhaustion-via-tests-file2-command
Credits
Tianbo Wang Xiaoyang Chen