Buffer overflow in Dronecode Px4 Drone Autopilot
CVE-2026-32743
PX4 is an open-source autopilot stack for drones and unmanned vehicles. Versions 1.17.0-rc2 and below are vulnerable to Stack-based Buffer Overflow through the MavlinkLogHandler, and are triggered via MAVLink log request. The LogEntry.filepath buffer is 60 bytes, but the sscanf function parses paths from the log list file with no width specifier, allowing a path longer than 60 characters to overflow the buffer. An attacker with MAVLink link access can trigger this by first creating deeply nested directories via MAVLink FTP, then requesting the log list. The flight controller MAVLink task crashes, losing telemetry and command capability and causing DoS. This issue has been fixed in this commit: https://github.com/PX4/PX4-Autopilot/commit/616b25a280e229c24d5cf12a03dbf248df89c474.
Vulnerability class: Buffer Overflow
EPSS: 0.004 (29.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Dronecode Px4_drone_autopilot — versions 1.17.0
- Px4 Px4-autopilot — versions <= 1.17.0-rc2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Mitigation, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-32743?
- CVE-2026-32743 is a medium-severity vulnerability in Dronecode Px4 Drone Autopilot, classified under Stack-based Buffer Overflow. CVSS score: 6.5/10. Published 2026-03-19.
- How severe is CVE-2026-32743?
- Medium severity. CVSS v3 base score is 6.5 out of 10.
- Is CVE-2026-32743 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.