cyfenced.com →

[ CVE-2026-102808 · Published 29 Sep 2026 ]

Vulnerability in PX4-Autopilot

CVSS 6.5 EPSS <1%No fix listed yet

[ Description ]Official description

PX4 Autopilot through 1.17.0 contains a NULL pointer dereference vulnerability in the sd_stress command where the -b byte count parameter is parsed without validation before being passed to malloc() and memset(). Attackers with shell access, including through MAVLink, can supply invalid byte count values to crash the flight controller.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References