Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

21 records

Vendor: PX4 Clear all filters
TI-2026-65506 CVE-2026-102809 · GHSA-cxqf-5vcw-ch3g

PX4 Autopilot through 1.17.0 Stack Exhaustion via tests file2 Command

Priority MEDIUM 64

PX4 Autopilot through 1.17.0 contains an uncontrolled stack allocation vulnerability in the file2 test command that fails to validate the write chunk size parameter.

CVSS 4.0HIGH 7.1 Adjacent network No auth No interaction EPSS 0.00483 Published 2026-09-29 No fix listed CWE-789
TI-2026-65505 CVE-2026-102808 · GHSA-6mwg-qhjp-3hf8

PX4 Autopilot through 1.17.0 NULL Pointer Dereference via sd_stress

Priority LOW 31

PX4 Autopilot through 1.17.0 contains a NULL pointer dereference vulnerability in the sd_stress command where the -b byte count parameter is parsed without validation before being passed to malloc() and memset().

CVSS 4.0HIGH 7.1 Adjacent network No auth No interaction EPSS 0.00244 Published 2026-09-29 No fix listed CWE-476
TI-2026-59273 CVE-2026-86714 · GHSA-6x78-rh4h-q7jx

PX4 Autopilot through 1.17.0 Stack Buffer Over-read via netman

Priority LOW 30

PX4 Autopilot through 1.17.0 contains a stack buffer over-read vulnerability in the netman system command that fails to validate interface name length.

CVSS 4.0MEDIUM 5.3 Adjacent network No auth No interaction EPSS 0.00332 Published 2026-09-08 No fix listed CWE-125
TI-2026-59272 CVE-2026-86713 · GHSA-26jx-wf7m-f9f4

PX4 Autopilot through 1.17.0 Use-After-Free in load_mon

Priority MEDIUM 64

PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the load_mon module's stop path where exit_and_cleanup() deletes the LoadMon object and frees the performance counter before perf_end() attempts to…

CVSS 4.0HIGH 7.1 Adjacent network No auth No interaction EPSS 0.00384 Published 2026-09-08 No fix listed CWE-416
TI-2026-58898 CVE-2026-86097 · GHSA-43c5-wgwh-x5c8

PX4 Autopilot through 1.17.0 Null Pointer Dereference via param select

Priority MEDIUM 64

PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in param_set_default_file() and param_set_backup_file() functions that allows attackers to crash the autopilot process.

CVSS 4.0HIGH 7.1 Adjacent network No auth No interaction EPSS 0.00395 Published 2026-09-04 No fix listed CWE-476
TI-2026-58226 CVE-2026-84698 · GHSA-qhw2-8wrm-m9rh

PX4 Autopilot sd_bench Heap Buffer Overflow via Block Size

Priority MEDIUM 64

PX4 Autopilot contains a heap buffer overflow vulnerability in the sd_bench command that writes a four-byte block number into a user-supplied sized allocation.

CVSS 4.0HIGH 7.1 Adjacent network No auth No interaction EPSS 0.00434 Published 2026-09-02 No fix listed CWE-787
TI-2023-24883 CVE-2023-46256

PX4-Autopilot Heap Buffer Overflow Bug

Priority HIGH 75

PX4-Autopilot provides PX4 flight control solution for drones.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00742 Published 2023-10-31 No fix listed CWE-120
TI-2020-08290 CVE-2020-10283 · GHSA-p772-7p8w-gc5x

RVD#3317: MAVLink version handshaking allows for an attacker to bypass authentication

Priority MEDIUM 45

The Micro Air Vehicle Link (MAVLink) protocol presents authentication mechanisms on its version 2.0 however according to its documentation, in order to maintain backwards compatibility, GCS and autopilot negotiate the ve…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0147 Published 2020-08-20 No fix listed CWE-288