PT-2026-25390 · Px4+2 · Px4-Autopilot+1

Kmm2003 · Publicado 2026-03-13 · Atualizado 2026-03-23 · CVE-2026-32707

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions PX4 autopilot versions prior to 1.17.0-rc2

Description PX4 autopilot is a flight control solution for drones. The tattu can component contains an unbounded memcpy function within its multi-frame assembly loop. This allows for stack memory overwrite when specifically crafted CAN frames are processed. If tattu can is enabled and running, an attacker capable of CAN injection can cause a crash (Denial of Service) and memory corruption.

Recommendations Versions prior to 1.17.0-rc2 should be updated to version 1.17.0-rc2 or later.

Exploit

Correção

Stack Overflow

Enumeração de Fraquezas

CWE-121

Identificadores relacionados

CVE-2026-32707

GHSA-WXWM-XMX9-HR32

Produtos afetados

Px4-Autopilot

Px4 Drone Autopilot

Referências · 7

• 🔥 https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-wxwm-xmx9-hr32 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32707.json · Exploit
• https://twitter.com/CVEnew/status/2032605824963453339 · Publicação no Twitter
• https://t.me/CVEtracker/47386 · Publicação no Telegram
• https://twitter.com/DazzlingDrone/status/2035906038017261642 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-32707 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-32707 · Nota de Segurança