CVE-2026-32743 in PX4-Autopilot
Summary
by MITRE • 03/19/2026
PX4 is an open-source autopilot stack for drones and unmanned vehicles. Versions 1.17.0-rc2 and below are vulnerable to Stack-based Buffer Overflow through the MavlinkLogHandler, and are triggered via MAVLink log request. The LogEntry.filepath buffer is 60 bytes, but the sscanf function parses paths from the log list file with no width specifier, allowing a path longer than 60 characters to overflow the buffer. An attacker with MAVLink link access can trigger this by first creating deeply nested directories via MAVLink FTP, then requesting the log list. The flight controller MAVLink task crashes, losing telemetry and command capability and causing DoS. This issue has been fixed in this commit: https://github.com/PX4/PX4-Autopilot/commit/616b25a280e229c24d5cf12a03dbf248df89c474.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 03/23/2026
The vulnerability CVE-2026-32743 affects the PX4 autopilot stack, an open-source software framework widely used in drone and unmanned vehicle applications. This stack serves as the core control system for autonomous flight operations and is deployed across various unmanned aerial vehicles requiring reliable flight control and telemetry management. The vulnerability exists within the MavlinkLogHandler component which processes MAVLink log requests, representing a critical security flaw that can compromise the operational integrity of unmanned systems. The affected versions include all releases up to and including 1.17.0-rc2, making a substantial portion of deployed PX4 systems potentially vulnerable to this attack vector.
The technical flaw manifests as a stack-based buffer overflow occurring in the LogEntry.filepath buffer management within the MavlinkLogHandler module. This buffer is allocated with only 60 bytes of storage space to accommodate file paths, yet the sscanf function processes incoming path data from log list files without specifying width constraints during parsing operations. This omission allows maliciously crafted file paths exceeding the 60-byte limit to overwrite adjacent stack memory, creating exploitable buffer overflow conditions. The vulnerability is triggered through legitimate MAVLink protocol communication channels, specifically when a client requests log information via MAVLink log request commands. The attack requires prior establishment of a MAVLink connection and the ability to execute MAVLink File Transfer Protocol (FTP) commands to create deeply nested directory structures that can then be leveraged to generate excessively long file paths.
The operational impact of this vulnerability extends beyond simple system instability to create serious safety and mission-critical concerns for unmanned vehicle operations. When exploited, the buffer overflow causes the flight controller's MAVLink task to crash, resulting in complete loss of telemetry communication and command capability between the ground station and unmanned vehicle. This denial-of-service condition can occur during critical flight operations, potentially leading to loss of vehicle control, mission failure, or hazardous situations where remote operators lose the ability to monitor or control their unmanned aircraft. The crash scenario is particularly concerning in autonomous flight applications where continuous communication and real-time control are essential for safe operation. The vulnerability demonstrates how seemingly benign protocol handling functions can create critical security weaknesses that compromise entire autonomous systems.
The mitigation approach for this vulnerability involves applying the patch referenced in the commit hash 616b25a280e229c24d5cf12a03dbf248df89c474, which implements proper width specifiers in the sscanf function calls to prevent buffer overflows. Organizations deploying PX4 systems should prioritize updating to patched versions and implementing network segmentation to limit unauthorized MAVLink access. The vulnerability aligns with CWE-121 Stack-based Buffer Overflow, which is categorized under the broader category of CWE-119 Improper Access of Resource Using Index or Pointer, and represents a classic example of how insufficient input validation can lead to critical security vulnerabilities. From an ATT&CK framework perspective, this vulnerability maps to T1059 Command and Scripting Interpreter and T1499 Endpoint Termination, as it enables an attacker to execute commands through MAVLink protocols and cause system termination through controlled crashes. Organizations should also consider implementing network monitoring to detect anomalous MAVLink traffic patterns that could indicate exploitation attempts, particularly when observing unusual FTP directory creation followed by log request sequences.