NULL pointer dereference in Px4 Px4-Autopilot
CVE-2026-102808
PX4 Autopilot through 1.17.0 contains a NULL pointer dereference vulnerability in the sd_stress command where the -b byte count parameter is parsed without validation before being passed to malloc() and memset(). Attackers with shell access, including through MAVLink, can supply invalid byte count values to crash the flight controller.
Published .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/PX4/PX4-Autopilot/pull/28795 (issue-tracking, patch)
- github.com/PX4/PX4-Autopilot/commit/c865dc9fde14d1391916775153aa271603c3c592 (patch)
- github.com/PX4/PX4-Autopilot/blob/d6f12ad1c4f70ad3230afd7d86e971421e02fef4/src/… (technical-description)
- github.com/PX4/PX4-Autopilot (product)
- www.vulncheck.com/advisories/px4-autopilot-through-1.17.0-null-pointer-derefere… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-102808?
- CVE-2026-102808 is a medium-severity vulnerability in Px4 Px4-Autopilot, classified under NULL Pointer Dereference. CVSS score: 6.5/10. Published 2026-09-29.
- How severe is CVE-2026-102808?
- Medium severity. CVSS v3 base score is 6.5 out of 10.