CVE-2026-32743-PX4-Autopilot-MavlinkLogHandler-Stack-Buffer-Overflow-DoS-

CVE-2026-32743 - PX4 Autopilot MavlinkLogHandler 栈缓冲区溢出（拒绝服务） -orange -blue 📜 描述 CVE-2026-32743 是 PX4 Autopilot ≤1.17.0-rc2 版本中 MavlinkLogHandler 的一个基于栈的缓冲区溢出 漏洞。 LogEntry.filepath 缓冲区仅有 60 字节 ，但 sscanf 在解析日志目录路径时未指定宽度限制符 。 拥有 MAVLink 链路访问权限 的攻击者可以： 1. 使用 MAVLink FTP 在 /fs/microsd/log/...

CVE-2026-32707-PX4-Autopilot-tattu_can-Stack-Buffer-Overflow-DoS-

-orange CVE-2026-32707 - PX4-Autopilot tattucan 栈缓冲区溢出（拒绝服务） ╔════════════════════════════════════════════════════════════════════════════════════════════╗ ║ ║ ║ ██████╗ █████╗ ███╗ ██╗██╗ ██╗ █████╗ ███╗ ███╗███████╗██████╗ ║ ║ ██╔══██╗██╔══██╗████╗ ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██...

CTT-Enhanced-PX4-Autopilot-Exploit-CVE-2026-32743

CTT-增强版PX4自动驾驶仪漏洞利用 — CVE-2026-32743 CVE-2026-32743 — PX4自动驾驶仪栈缓冲区溢出 CTT增强版：33层时间级联无人机拒绝服务攻击。原始漏洞利用通过60字节溢出使MAVLink任务崩溃。CTT版本将溢出分布到33个时间层，每层具有相位共振时序和时间楔形滤波。结果：持久性拒绝服务。无法修补。 CTT-增强版PX4自动驾驶仪漏洞利用 — CVE-2026-32743 🔥 概述...

PX4-Autopilot

业界构建所依赖的自动驾驶仪堆栈。 关于 PX4 是一款面向无人机和无人载具的开源自动驾驶仪堆栈。它支持多旋翼、固定翼、垂直起降（VTOL）、地面车辆，以及从竞速穿越机到工业勘测飞机等众多实验性平台。它运行于 NuttX、Linux 和 macOS 之上。采用 BSD 3-Clause 许可证。 为什么选择 PX4 模块化架构。 PX4 围绕 uORB 构建，这是一种兼容 DDS 的发布/订阅中间件。各模块完全并行化且线程安全。您可以构建自定义配置，并裁剪掉不需要的部分。 广泛的硬件支持。 PX4 可在多种 自动驾驶仪板卡 上运行，并通过 Pixhawk...

CVE-2026-102808

PX4 Autopilot through 1.17.0 contains a NULL pointer dereference vulnerability in the sdstress command where the -b byte count parameter is parsed without validation before being passed to malloc and memset. Attackers with shell access, including through MAVLink, can supply invalid byte count...

CVE-2026-102809

PX4 Autopilot through 1.17.0 contains an uncontrolled stack allocation vulnerability in the file2 test command that fails to validate the write chunk size parameter. Attackers with shell access can supply an excessively large value to the -c option to trigger stack overflow and crash the flight...

EUVD-2026-89109

PX4 Autopilot through 1.17.0 contains an uncontrolled stack allocation vulnerability in the file2 test command that fails to validate the write chunk size parameter. Attackers with shell access can supply an excessively large value to the -c option to trigger stack overflow and crash the flight...

CVE-2026-102808 PX4 Autopilot through 1.17.0 NULL Pointer Dereference via sd_stress

PX4 Autopilot through 1.17.0 contains a NULL pointer dereference vulnerability in the sdstress command where the -b byte count parameter is parsed without validation before being passed to malloc and memset. Attackers with shell access, including through MAVLink, can supply invalid byte count...

CVE-2026-102808

PX4 Autopilot versions through 1.17.0 are vulnerable to a NULL pointer dereference within the sd_stress command. The root cause is the lack of validation for the -b byte count parameter before it is processed by malloc() and memset(). An attacker with shell access, which can be obtained via MAVLi...

EUVD-2026-89108

PX4 Autopilot through 1.17.0 contains a NULL pointer dereference vulnerability in the sdstress command where the -b byte count parameter is parsed without validation before being passed to malloc and memset. Attackers with shell access, including through MAVLink, can supply invalid byte count...

CVE-2026-102808 PX4 Autopilot through 1.17.0 NULL Pointer Dereference via sd_stress

PX4 Autopilot through 1.17.0 contains a NULL pointer dereference vulnerability in the sdstress command where the -b byte count parameter is parsed without validation before being passed to malloc and memset. Attackers with shell access, including through MAVLink, can supply invalid byte count...

CVE-2026-102809 PX4 Autopilot through 1.17.0 Stack Exhaustion via tests file2 Command

PX4 Autopilot through 1.17.0 contains an uncontrolled stack allocation vulnerability in the file2 test command that fails to validate the write chunk size parameter. Attackers with shell access can supply an excessively large value to the -c option to trigger stack overflow and crash the flight...

CVE-2026-102809 PX4 Autopilot through 1.17.0 Stack Exhaustion via tests file2 Command

PX4 Autopilot through 1.17.0 contains an uncontrolled stack allocation vulnerability in the file2 test command that fails to validate the write chunk size parameter. Attackers with shell access can supply an excessively large value to the -c option to trigger stack overflow and crash the flight...

CVE-2026-102809

PX4 Autopilot versions through 1.17.0 are vulnerable to a stack exhaustion vulnerability within the file2 test command. The root cause is a failure to validate the write chunk size parameter , allowing an attacker with shell access to provide an excessively large value to the -c option . This act...

CVE-2026-102809 PX4 Autopilot through 1.17.0 Stack Exhaustion via tests file2 Command

PX4 Autopilot through 1.17.0 contains an uncontrolled stack allocation vulnerability in the file2 test command that fails to validate the write chunk size parameter. Attackers with shell access can supply an excessively large value to the -c option to trigger stack overflow and crash the flight...

PX4-Military-UAV-Autopilot-1.12.3-Stack-Buffer-Overflow-Exploit-CVE-2025-5640-

PX4 军用无人机自动驾驶仪 =1.12.3 栈缓冲区溢出漏洞利用 CVE-2025-5640 作者: Mohammed Idrees Banyamer @banyamersecurity GitHub: https://github.com/mbanyamer 日期： 2025-06-21 测试环境： Ubuntu 20.04 LTS + PX4 SITL jMAVSim CVE： CVE-2025-5640 类型： 通过栈缓冲区溢出导致的拒绝服务 DoS 平台： 跨平台（军用无人机 / PX4 SITL / 基于 Linux 的自动驾驶仪地面站） 作者国家： 约旦 描述 PX4...

CVE-2026-102808: NULL Pointer Dereference

PX4 Autopilot through 1.17.0 contains a NULL pointer dereference vulnerability in the sdstress command where the -b byte count parameter is parsed without validation before being passed to malloc and memset. Attackers with shell access, including through MAVLink, can supply invalid byte count...

CVE-2026-86713

PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the loadmon module's stop path where exitandcleanup deletes the LoadMon object and frees the performance counter before perfend attempts to access it. Attackers can trigger this vulnerability by issuing the loadmon stop comma...

CVE-2026-86714

PX4 Autopilot through 1.17.0 contains a stack buffer over-read vulnerability in the netman system command that fails to validate interface name length. Attackers can supply interface names of 74 bytes or more via the -i option to read beyond buffer boundaries, leaking stack memory to console outp...

CVE-2026-86714 PX4 Autopilot through 1.17.0 Stack Buffer Over-read via netman

PX4 Autopilot through 1.17.0 contains a stack buffer over-read vulnerability in the netman system command that fails to validate interface name length. Attackers can supply interface names of 74 bytes or more via the -i option to read beyond buffer boundaries, leaking stack memory to console outp...