PT-2026-7903 · Ros2+1 · Navigation2+1

Steve Macenski · Published 2026-02-12 · Updated 2026-02-15 · CVE-2026-26011

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions navigation2 versions prior to 1.3.11

Description navigation2 is a ROS 2 Navigation Framework and System. A heap out-of-bounds write issue exists in Nav2 AMCL’s particle filter clustering logic. An unauthenticated attacker on the same ROS 2 DDS domain can trigger a negative index write into heap memory by publishing a crafted geometry msgs/PoseWithCovarianceStamped message to the /initialpose topic. The message must contain extreme covariance values. In Release builds, runtime protection is disabled. This allows controlled corruption of heap chunk metadata, potentially leading to further exploitation or a denial of service that halts navigation. The vulnerable code attempts to access set->clusters[-1].

Recommendations Update to a version later than 1.3.11.

Exploit

Fix

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

CVE-2026-26011

GHSA-MGJ5-G2P6-GC5X

Affected Products

Geometry Msgs/Posewithcovariancestamped

Navigation2

References · 8

• 🔥 https://github.com/ros-navigation/navigation2/security/advisories/GHSA-mgj5-g2p6-gc5x · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26011.json · Exploit
• https://github.com/ros-navigation/navigation2/commit/d09ea82477ce9234678a6febf6890235e0a7ce12 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-26011 · Security Note
• https://osv.dev/vulnerability/CVE-2026-26011 · Vendor Advisory
• https://github.com/ros-navigation/navigation2/releases/tag/1.3.11 · Note
• https://twitter.com/0dayPublishing/status/2023156547623256473 · Twitter Post
• https://twitter.com/CVEnew/status/2022053673501708423 · Twitter Post