Medium severity · published Mar 13, 2026
CVE-2026-32713
PX4 Autopilot MAVLink FTP Session Validation Logic Error Allows Operations on Invalid File Descriptors
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, A logic error in the PX4 Autopilot MAVLink FTP session validation uses incorrect boolean logic (&& instead of ||), allowing BurstReadFile and WriteFile operations to proceed with invalid sessions or closed file descriptors. This enables an unauthenticated attacker to put the FTP subsystem into an inconsistent state, trigger operations on invalid file descriptors, and bypass session isolation checks. This vulnerability is fixed in 1.17.0-rc2.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PX
PX4-Autopilot · PX4
< 1.17.0-rc2 · source: vendor
PD
Px4 Drone Autopilot · Dronecode
before 1.17.0; 1.17.0; 1.17.0; 1.17.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-32713
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-32713
Exploit
https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-pp2c-jr5g-6f2m
More from PX4-Autopilot
8.1
CVE-2026-32706
PX4 autopilot has a global buffer overflow in crsf_rc via oversized variable-length known packet
8.0
CVE-2026-32708
Zenoh uORB Subscriber Allows Arbitrary Stack Allocation (PX4/PX4-Autopilot)
7.8
CVE-2025-15150
PX4 PX4-Autopilot mavlink_log_handler.cpp log_entry_from_id stack-based overflow
7.1
CVE-2026-86713
PX4 Autopilot through 1.17.0 Use-After-Free in load_mon
6.8
CVE-2026-32709
PX4 Autopilot MAVLink FTP Unauthenticated Path Traversal (Arbitrary File Read/Write/Delete)