PX4 Autopilot CVE-2026-102808

Requires access to the PX4 flight-controller command shell - specifically the ability to invoke the sd_stress system command with a crafted -b (byte count) parameter set outside the valid 1-10000 range. This shell is reachable over the drone's MAVLink telemetry/command link (adjacent, AV:A), so the attacker must be on that link rather than the open internet. Limiting factors: the attacker must reach the MAVLink/console interface and be able to run system commands; deployments that authenticate or restrict the MAVLink shell, or disable the sd_stress command in production firmware, are not exploitable. Impact is limited to a crash - no code execution or data disclosure.

This is a moderate-severity availability-only issue, not a high-impact priority. The vendor CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) scores 7.1 driven entirely by VA:H (availability high) - there is NO confidentiality or integrity impact, so this is purely a denial-of-service (flight-controller crash), consistent with CWE-476. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so exploitation status is: no public exploit identified at time of analysis. A meaningful signal conflict exists: the CVSS vector asserts PR:N (unauthenticated), but the description states the attacker needs 'shell access, including through MAVLink' - this is a prerequisite that raises the bar beyond raw network reach, though MAVLink command shells are frequently exposed without authentication on the control link, which makes PR:N defensible. AV:A (adjacent) correctly reflects that exploitation happens over the drone's radio/telemetry link rather than the open internet. Overall: real but bounded risk - a crash of safety-critical avionics is serious operationally, but there is no code execution, no data exposure, a patch exists, and no evidence of active exploitation.

An attacker within range of a PX4-based drone's MAVLink telemetry/command link opens the flight-controller shell and runs the sd_stress command with an out-of-range -b byte count (e.g., a value that forces malloc() to return NULL). The subsequent memset() on the NULL pointer dereferences it and crashes the flight controller, potentially causing loss of control of the aircraft. No public exploit code is identified, but the trigger is trivial once shell/MAVLink access is obtained.