CVE-2026-102809 in Autopilot
Summary
by MITRE • 09/29/2026
PX4 Autopilot through 1.17.0 contains an uncontrolled stack allocation vulnerability in the file2 test command that fails to validate the write chunk size parameter. Attackers with shell access can supply an excessively large value to the -c option to trigger stack overflow and crash the flight controller.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The PX4 Autopilot software, a widely used open-source autopilot system for drones and unmanned aerial vehicles, contains a critical uncontrolled stack allocation vulnerability in its file2 test command utility within versions up through 1.17.0. This flaw stems from an insufficient validation of the write chunk size parameter provided by the user during execution. Specifically, when invoking the file2 test command with the -c option to specify the chunk size for writing data, the application fails to perform adequate bounds checking on this input value before allocating memory on the stack. As a result, if an attacker supplies an excessively large integer value for the chunk size, the system attempts to allocate a disproportionately large buffer on the limited stack space available within the flight controller's embedded environment.
This lack of input validation directly leads to a classic stack-based buffer overflow condition. In resource-constrained embedded systems like those running PX4, the stack is typically small and shared among various tasks and interrupts. When an oversized chunk size triggers the allocation of more data than the allocated stack frame can accommodate, it overwrites adjacent memory locations on the stack. This corruption includes critical control data such as return addresses, saved base pointers, and potentially other local variables or function context information. The immediate operational impact is a crash of the flight controller process due to segmentation faults or illegal memory access exceptions triggered by the corrupted stack state. In the context of autonomous flight systems, such a crash can lead to an immediate loss of control over the vehicle, posing significant safety risks including potential crashes and hardware damage.
The vulnerability requires shell access for exploitation, which implies that it is not remotely exploitable via network interfaces but rather targets users or processes with local command-line interface privileges on the device. This classification aligns with CWE-121: Stack-based Buffer Overflow, as the root cause involves writing data beyond the boundaries of a stack buffer due to unchecked input sizes. Furthermore, from an adversarial perspective, this vulnerability can be mapped to MITRE ATT&CK technique T1059.004: Command and Scripting Interpreter::Unix Shell Commands, where an attacker leverages shell access to execute specific commands that trigger the flaw for denial of service or further exploitation if additional memory corruption primitives are present in subsequent code paths.
Mitigation strategies should focus on both immediate patching and long-term secure coding practices. The primary remediation is to upgrade PX4 Autopilot to a version later than 1.17.0, where this specific validation logic has been corrected. For systems that cannot be immediately updated, administrators must enforce strict access controls to the shell interface of the flight controller hardware, ensuring that only trusted personnel with verified identities can execute diagnostic or test commands like file2. Additionally, implementing runtime protection mechanisms such as stack canaries and non-executable stack memory policies can help detect or prevent exploitation attempts by terminating processes before critical system components are compromised. Future development cycles should integrate static analysis tools configured to flag unbounded allocations based on user-supplied parameters, ensuring that all input sizes are validated against maximum allowable limits defined by the embedded OS constraints before any memory allocation occurs.