Vulnerability · Published Sep 29, 2026 · Assigned by VulnCheck
CVE-2026-102809PX4 Autopilot through 1.17.0 Stack Exhaustion via tests file2 Command
Medium 6.5
In plain English
A medium-severity security flaw in PX4-Autopilot from PX4. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.5%top 58.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
PX4 Autopilot through 1.17.0 contains an uncontrolled stack allocation vulnerability in the file2 test command that fails to validate the write chunk size parameter. Attackers with shell access can supply an excessively large value to the -c option to trigger stack overflow and crash the flight controller.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PX4 | PX4-Autopilot | 0 – through 1.17.0 |
Weakness: CWE-789 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- Pull Request #28586 issue-tracking, patch
- Patch Commit patch
- https://github.com/PX4/PX4-Autopilot/blob/d6f12ad1c4f70ad3230afd7d86e971421e02fef4/src/systemcmds/tests/test_file2.c#L86-L130 technical-description
- https://github.com/PX4/PX4-Autopilot product
- VulnCheck Advisory: PX4 Autopilot through 1.17.0 Stack Exhaustion via tests file2 Command third-party-advisory