Medium severity · published Sep 29, 2026
CVE-2026-102808
PX4 Autopilot through 1.17.0 NULL Pointer Dereference via sd_stress
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
PX4 Autopilot through 1.17.0 contains a NULL pointer dereference vulnerability in the sd_stress command where the -b byte count parameter is parsed without validation before being passed to malloc() and memset(). Attackers with shell access, including through MAVLink, can supply invalid byte count values to crash the flight controller.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PX
PX4-Autopilot · PX4
through 1.17.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-102808
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-102808
issue-tracking
https://github.com/PX4/PX4-Autopilot/pull/28795
patch
https://github.com/PX4/PX4-Autopilot/commit/c865dc9fde14d1391916775153aa271603c3c592
technical-description
https://github.com/PX4/PX4-Autopilot/blob/d6f12ad1c4f70ad3230afd7d86e971421e02fef4/src/systemcmds/sd_stress/sd_stress.cpp#L186-L204
product
https://github.com/PX4/PX4-Autopilot
third-party-advisory
https://www.vulncheck.com/advisories/px4-autopilot-through-1.17.0-null-pointer-dereference-via-sd-stress
More from PX4-Autopilot
8.1
CVE-2026-32706
PX4 autopilot has a global buffer overflow in crsf_rc via oversized variable-length known packet
8.0
CVE-2026-32708
Zenoh uORB Subscriber Allows Arbitrary Stack Allocation (PX4/PX4-Autopilot)
7.8
CVE-2025-15150
PX4 PX4-Autopilot mavlink_log_handler.cpp log_entry_from_id stack-based overflow
7.1
CVE-2026-86713
PX4 Autopilot through 1.17.0 Use-After-Free in load_mon
6.8
CVE-2026-32709
PX4 Autopilot MAVLink FTP Unauthenticated Path Traversal (Arbitrary File Read/Write/Delete)