EUVD-2026-12148Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, the BST telemetry probe writes a string terminator using a device-provided length without bounds. A malicious BST device can report an oversized dev_name_len, causing a stack overflow in the driver and crashing the task (or enabling code execution). This vulnerability is fixed in 1.17.0-rc2.
AnalysisAI
PX4 autopilot versions prior to 1.17.0-rc2 contain a stack overflow vulnerability in the BST telemetry probe driver that allows a malicious BST device to trigger a buffer overflow by reporting an oversized dev_name_len parameter without bounds checking. An attacker with physical access to inject a malicious BST device can crash the autopilot task or potentially achieve arbitrary code execution, impacting drone flight safety and control systems. No active KEV exploitation data or public POC is currently documented, but the vulnerability is patched in version 1.17.0-rc2.
Technical ContextAI
The vulnerability exists in PX4-Autopilot's BST (Bosch Sensortec) telemetry probe driver, which interfaces with external sensor/telemetry devices via a device communication protocol. The root cause is classified as CWE-121 (Stack-based Buffer Overflow), occurring when the driver writes a string terminator to the stack without validating the dev_name_len field provided by the device. The affected CPE is cpe:2.3:a:px4:px4-autopilot:*:*:*:*:*:*:*:* for versions before 1.17.0-rc2. The BST protocol permits device-provided metadata (device name length) to be used directly in memory operations on the driver's stack, enabling an out-of-bounds write when a malicious device reports an abnormally large length value.
More in Px4 Autopilot
View allStack overflow vulnerability in PX4 autopilot drone flight control software (versions prior to 1.17.0-rc2) where the Zen
Null pointer dereference in PX4 Autopilot through 1.17.0 allows any party with PX4 shell access to crash the autopilot p
Buffer overflow vulnerability in PX4 autopilot drone firmware versions before 1.17.0-rc2 that allows adjacent network at
Use-after-free in PX4 Autopilot through 1.17.0 allows an adjacent unauthenticated attacker to corrupt flight-stack heap
Use-after-free in PX4 Autopilot through v1.17.0 permits adjacent attackers with shell access to corrupt the autopilot's
An unauthenticated path traversal vulnerability in PX4 Autopilot's MAVLink FTP implementation (CWE-22) allows any MAVLin
Stack buffer over-read in PX4 Autopilot through v1.17.0 exposes stack memory via the netman system command's interface n
PX4 Autopilot versions prior to 1.17.0-rc1 contain a heap-use-after-free vulnerability in the MavlinkShell::available()
PX4 autopilot versions prior to 1.17.0-rc2 contain an unbounded memcpy vulnerability in the tattu_can module that allows
PX4 Autopilot prior to version 1.17.0-rc2 contains a boolean logic error in MAVLink FTP session validation that uses AND
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today