PT-2026-25390 · Px4+2 · Px4-Autopilot+1

Kmm2003 · Published 2026-03-13 · Updated 2026-03-23 · CVE-2026-32707

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions PX4 autopilot versions prior to 1.17.0-rc2

Description PX4 autopilot is a flight control solution for drones. The tattu can component contains an unbounded memcpy function within its multi-frame assembly loop. This allows for stack memory overwrite when specifically crafted CAN frames are processed. If tattu can is enabled and running, an attacker capable of CAN injection can cause a crash (Denial of Service) and memory corruption.

Recommendations Versions prior to 1.17.0-rc2 should be updated to version 1.17.0-rc2 or later.

Exploit

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2026-32707

GHSA-WXWM-XMX9-HR32

Affected Products

Px4-Autopilot

Px4 Drone Autopilot

References · 7

• 🔥 https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-wxwm-xmx9-hr32 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32707.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-32707 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32707 · Security Note
• https://twitter.com/CVEnew/status/2032605824963453339 · Twitter Post
• https://t.me/CVEtracker/47386 · Telegram Post
• https://twitter.com/DazzlingDrone/status/2035906038017261642 · Twitter Post