PX4-Autopilot CVE-2025-15150

Exploitation requires local access to the PX4 device and the ability to influence the log directory listing that MavlinkLogHandler reads: the vulnerable code parses each log-index line with sscanf(line, "%" PRIu32 " %" PRIu32 " %s", ...) with NO field-width limit, writing an attacker-influenced filepath token into a fixed stack buffer (filepath[60] in the listing path, and the LogEntry.filepath buffer in log_entry_from_id). A filepath field longer than the destination buffer overflows it. Limiting factors: no remote/network vector (AV:L) and some privilege is required (PR:L) to place or control the oversized log entry; there is no user-interaction requirement (UI:N). This is not exploitable against a default configuration purely over the network - an attacker must already have local access or write influence over the log state the handler parses.

This is a genuine but low-to-moderate priority issue. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) scores 4.8 (medium) and all three impact metrics are only Low (VC:L/VI:L/VA:L), with no scope/subsequent-system impact. The decisive limiting signal is the Local attack vector combined with required privileges (PR:L): the CVE text explicitly states 'the attack is only possible with local access', which is consistent with the CVSS vector - the two signals agree, not conflict. Publicly available exploit code exists (referenced GitHub issue #26118 and PR #26124), which raises practical reproducibility, but there is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of widespread or active exploitation. POC availability must not be conflated with active exploitation. Net: a real, patch-worthy defect in an embedded flight-controller code path, but the local-only vector and modest, non-escalating impact make it a routine-patch item rather than an emergency. No SSVC decision data or EPSS probability was supplied, so automatability and real-world exploitation likelihood cannot be independently graded from the input.

An attacker with local access to the PX4 flight controller (or a process able to influence the on-device log directory/listing) plants a log entry whose filepath field exceeds the fixed destination buffer. When a MAVLink client requests a log listing, MavlinkLogHandler::state_listing / log_entry_from_id parses the line with an unbounded sscanf("%s") and overflows the stack buffer. Public exploit/POC material is referenced in the linked GitHub issue and pull request.