PT-2026-26168 · Px4 · Px4

Zhangteng0526 · Published 2026-03-18 · Updated 2026-03-21 · CVE-2026-32743

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PX4 versions 1.17.0-rc2 and below

Description PX4 is an open-source autopilot stack for drones and unmanned vehicles. A stack-based buffer overflow exists through the MavlinkLogHandler, triggered via a MAVLink log request. The LogEntry.filepath buffer is 60 bytes, but the sscanf function parses paths from the log list file without a width specifier, allowing paths exceeding 60 characters to overflow the buffer. An attacker with MAVLink link access can trigger this by creating deeply nested directories via MAVLink FTP, then requesting the log list. This causes the flight controller MAVLink task to crash, resulting in a denial-of-service (DoS) condition and loss of telemetry and command capability.

Recommendations Versions prior to 1.17.0-rc2 should be updated.

Exploit

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2026-32743

GHSA-97C4-68R9-96P5

Affected Products

Px4

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32743.json · Exploit
• https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-97c4-68r9-96p5 · Vendor Advisory
• https://github.com/PX4/PX4-Autopilot/commit/616b25a280e229c24d5cf12a03dbf248df89c474 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-32743 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32743 · Vendor Advisory
• https://twitter.com/NewsNerdie/status/2034631546112442809 · Twitter Post
• https://twitter.com/cyberbivash/status/2034436184093475037 · Twitter Post
• https://twitter.com/CVEnew/status/2034520403247321129 · Twitter Post
• https://twitter.com/CVEarity/status/2035325324221948157 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2034455043986927694 · Twitter Post