Login Request a demo
Medium severity · published Sep 29, 2026
CVE-2026-102809
PX4 Autopilot through 1.17.0 Stack Exhaustion via tests file2 Command
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
PX4 Autopilot through 1.17.0 contains an uncontrolled stack allocation vulnerability in the file2 test command that fails to validate the write chunk size parameter. Attackers with shell access can supply an excessively large value to the -c option to trigger stack overflow and crash the flight controller.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PX
PX4-Autopilot · PX4
through 1.17.0 · source: vendor
Affected product
PX
PX4-Autopilot
PX4
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-102809
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-102809
issue-tracking
https://github.com/PX4/PX4-Autopilot/pull/28586
patch
https://github.com/PX4/PX4-Autopilot/commit/46a77d8ad15e7929ef261c41083dffd1bbfa9f85
technical-description
https://github.com/PX4/PX4-Autopilot/blob/d6f12ad1c4f70ad3230afd7d86e971421e02fef4/src/systemcmds/tests/test_file2.c#L86-L130
product
https://github.com/PX4/PX4-Autopilot
third-party-advisory
https://www.vulncheck.com/advisories/px4-autopilot-through-1.17.0-stack-exhaustion-via-tests-file2-command
More from PX4-Autopilot
8.1
CVE-2026-32706
PX4 autopilot has a global buffer overflow in crsf_rc via oversized variable-length known packet
8.0
CVE-2026-32708
Zenoh uORB Subscriber Allows Arbitrary Stack Allocation (PX4/PX4-Autopilot)
7.8
CVE-2025-15150
PX4 PX4-Autopilot mavlink_log_handler.cpp log_entry_from_id stack-based overflow
7.1
CVE-2026-86713
PX4 Autopilot through 1.17.0 Use-After-Free in load_mon
6.8
CVE-2026-32709
PX4 Autopilot MAVLink FTP Unauthenticated Path Traversal (Arbitrary File Read/Write/Delete)