IoT
CVE-2026-32743
MEDIUM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While the CVSS v3.1 score of 6.5 (Medium-High) reflects a high-impact denial of service, real-world exploitation probability is mitigated by several factors: the attack vector is Adjacent (AV:A), requiring network proximity or direct connection to the MAVLink link, and no user interaction is required. The CVSS vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates low attack complexity and no privilege requirement, but the availability impact is high (crash of flight control telemetry). This is a legitimate priority for drone operators and autonomous vehicle deployments in networked environments, particularly where MAVLink links are exposed to untrusted networks. The existence of a published patch and specific commit reference indicates this was a real vulnerability that has been remediated; without KEV status or EPSS data in the provided intelligence, the risk should be assessed as moderate-to-high for unpatched systems in active use. |
| Exploit ScenarioDerived | An attacker with access to a drone's MAVLink communication channel (via proximity to its RF link, compromised ground station, or network access) first creates a series of deeply nested directories using the MAVLink FTP service (e.g., /a/b/c/d/.../path/to/file with total length exceeding 60 bytes). When the attacker then requests the log list via a MAVLink log request message, the sscanf parser attempts to copy the full nested path into the 60-byte LogEntry.filepath buffer without bounds checking, triggering a stack overflow that corrupts adjacent stack memory and crashes the MAVLink handler task. This results in immediate loss of telemetry data transmission and command reception, leaving the drone unable to receive control inputs or report status to the ground station—a critical denial-of-service condition during flight operations. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 19, 2026
Stack-based buffer overflow in PX4 autopilot versions 1.17.0-rc2 and below allows attackers with MAVLink link access to crash the flight controller by exploiting an unconstrained sscanf operation in the MavlinkLogHandler. An attacker can trigger this by creating deeply nested directories via MAVLink FTP and then requesting the log list, causing the MAVLink task to crash and resulting in loss of telemetry and command capability. This denial of service affects drone and unmanned vehicle systems relying on vulnerable PX4 versions.
Earlier versions of this analysis (1)
A stack-based buffer overflow vulnerability exists in PX4 autopilot versions 1.17.0-rc2 and below, triggered through the MavlinkLogHandler when processing MAVLink log requests with excessively long file paths. An attacker with network access to the MAVLink communication link can exploit this to crash the flight controller's MAVLink task, causing loss of telemetry and command capability (denial of service). A patch is available via GitHub commit 616b25a280e229c24d5cf12a03dbf248df89c474.
RemediationAI
Upgrade PX4 to a version that includes the security fix from commit 616b25a280e229c24d5cf12a03dbf248df89c474 or later. This is available through the official PX4 GitHub repository (https://github.com/PX4/PX4-Autopilot). Until patching is feasible, implement network-level controls to restrict MAVLink access to trusted sources only, disable FTP functionality if not required for operations, and monitor for unexpected MAVLink log request patterns that may indicate exploitation attempts. For embedded deployments, consider deploying behind a MAVLink proxy that validates and truncates oversized file path requests before forwarding to the flight controller.
Affected ProductsAI
PX4 autopilot stack versions 1.17.0-rc2 and all earlier versions are affected. The vulnerability has been addressed in PX4 versions following the security fix commit 616b25a280e229c24d5cf12a03dbf248df89c474. Organizations using PX4 on unmanned aerial vehicles (UAVs), autonomous ground vehicles, or other unmanned systems with MAVLink-enabled flight controllers should verify their deployment version. The fix is available via the official PX4 GitHub repository security advisory at https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-97c4-68r9-96p5.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the MavlinkLogHandler component of PX4, which processes incoming MAVLink protocol requests for drone telemetry and command execution. The root cause (CWE-121: Stack-based Buffer Overflow) occurs in the LogEntry.filepath buffer, a 60-byte stack variable used to store file paths parsed from the log list file. The vulnerable code uses the sscanf function without a width specifier when parsing paths, allowing an attacker to write beyond the 60-byte boundary. MAVLink is the primary communication protocol used by PX4 for drone command and control, making this a network-accessible attack surface. The attack leverages MAVLink FTP functionality to first create deeply nested directory structures, which when listed via MAVLink log request, produce path strings exceeding 60 characters that overflow the fixed-size buffer.
Know when IoT gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
PX4 is an open-source autopilot stack for drones and unmanned vehicles. Versions 1.17.0-rc2 and below are vulnerable to Stack-based Buffer Overflow through the MavlinkLogHandler, and are triggered via MAVLink log request. The LogEntry.filepath buffer is 60 bytes, but the sscanf function parses paths from the log list file with no width specifier, allowing a path longer than 60 characters to overflow the buffer. An attacker with MAVLink link access can trigger this by first creating deeply nested directories via MAVLink FTP, then requesting the log list. The flight controller MAVLink task crashes, losing telemetry and command capability and causing DoS. This issue has been fixed in this commit: https://github.com/PX4/PX4-Autopilot/commit/616b25a280e229c24d5cf12a03dbf248df89c474.
Executive ViewAI
Organizations using PX4 should be aware of notable risk from CVE-2026-32743, a stack-based buffer overflow vulnerability rated CVSS 6.5. Exploitation could cause memory corruption or application crashes. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: enable ASLR/DEP, apply network segmentation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
A command injection vulnerability (CVSS 9.8). Risk factors: public PoC available.
Plaintext daemon credentials in IDC SFX2100 routing config files (zebra, bgpd, ospfd, ripd). CVSS 10.0. PoC available.
Remote command execution in Aqara Hub firmware (Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025) stem
Kede Electronics IoT smart water meter monitoring platform v1.0 has a SQL injection allowing attackers to compromise the
An unauthenticated OS command injection in the CGI handler of Netcore NR289-GE firmware 1.4.5102 lets remote attackers e
Unauthenticated network attackers can bypass authentication in the Netcore NR289-GE router's boa_temp web handler and ab
Remote unauthenticated OS command injection in Netcore NR289-GE firmware 1.4.5102 allows attackers to execute arbitrary
Unauthenticated OS command injection in the Netcore NR289-GE router (firmware 1.4.5102) lets any remote attacker who can
A stack-based buffer overflow in the devdiscover service of FAST FAC1900R firmware 20190827_2.0.2 lets unauthenticated r
RIOT IoT operating system has an out-of-bounds read vulnerability (CVSS 9.1) that could lead to information disclosure o
Command injection in the Ziroom ZHOME A0101 smart-home hub (firmware 1.0.1.0) allows an attacker with high-privilege aut
Authenticated command injection in Ziroom ZHOME A0101 firmware 1.0.1.0 lets a privileged user execute arbitrary operatin
Exploit-DB