What is the CVSS score of CVE-2026-32705?

CVE-2026-32705 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Px4 Autopilot are affected by CVE-2026-32705?

Organizations using PX4 autopilot should be aware of notable risk from CVE-2026-32705, a stack-based buffer overflow vulnerability rated CVSS 6.8.. A patch is available.

How to fix or mitigate CVE-2026-32705?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Px4 Autopilot CVE-2026-32705

EUVD-2026-12148 MEDIUM

Stack-based Buffer Overflow (CWE-121)

2026-03-13 GitHub_M

RCE Stack Overflow Buffer Overflow Px4 Autopilot

6.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.8 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

1.17.0-rc2

EUVD ID Assigned

Mar 13, 2026 - 22:01 euvd

EUVD-2026-12148

Analysis Generated

Mar 13, 2026 - 22:01 vuln.today

CVE Published

Mar 13, 2026 - 21:15 nvd

MEDIUM 6.8

DescriptionGitHub Advisory

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, the BST telemetry probe writes a string terminator using a device-provided length without bounds. A malicious BST device can report an oversized dev_name_len, causing a stack overflow in the driver and crashing the task (or enabling code execution). This vulnerability is fixed in 1.17.0-rc2.

AnalysisAI

PX4 autopilot versions prior to 1.17.0-rc2 contain a stack overflow vulnerability in the BST telemetry probe driver that allows a malicious BST device to trigger a buffer overflow by reporting an oversized dev_name_len parameter without bounds checking. An attacker with physical access to inject a malicious BST device can crash the autopilot task or potentially achieve arbitrary code execution, impacting drone flight safety and control systems. No active KEV exploitation data or public POC is currently documented, but the vulnerability is patched in version 1.17.0-rc2.

Technical ContextAI

The vulnerability exists in PX4-Autopilot's BST (Bosch Sensortec) telemetry probe driver, which interfaces with external sensor/telemetry devices via a device communication protocol. The root cause is classified as CWE-121 (Stack-based Buffer Overflow), occurring when the driver writes a string terminator to the stack without validating the dev_name_len field provided by the device. The affected CPE is cpe:2.3:a:px4:px4-autopilot:*:*:*:*:*:*:*:* for versions before 1.17.0-rc2. The BST protocol permits device-provided metadata (device name length) to be used directly in memory operations on the driver's stack, enabling an out-of-bounds write when a malicious device reports an abnormally large length value.