CVE-2026-32707

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, tattu_can contains an unbounded memcpy in its multi-frame assembly loop, allowing stack memory overwrite when crafted CAN frames are processed. In deployments where tattu_can is enabled and running, a CAN-injection-capable attacker can trigger a crash (DoS) and memory corruption. This vulnerability is fixed in 1.17.0-rc2.

CVSS v3 5.2 MEDIUM

5.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 4.2

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-wxwm-xmx9-hr32	Exploit Vendor Advisory
https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-wxwm-xmx9-hr32	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:dronecode:px4_drone_autopilot::::::::
	cpe:2.3:a:dronecode:px4_drone_autopilot:1.17.0:alpha1::::::
	cpe:2.3:a:dronecode:px4_drone_autopilot:1.17.0:beta1::::::
	cpe:2.3:a:dronecode:px4_drone_autopilot:1.17.0:rc1::::::

History

No history.

Information

Published : 2026-03-16 14:19

Updated : 2026-03-17 16:16

NVD link : CVE-2026-32707

Mitre link : CVE-2026-32707

CVE.ORG link : CVE-2026-32707

JSON object : View

Products Affected

dronecode

px4_drone_autopilot

CWE

CWE-121

Stack-based Buffer Overflow

{"id": "CVE-2026-32707", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.2, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 0.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 0.9}]}, "published": "2026-03-16T14:19:41.783", "references": [{"url": "https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-wxwm-xmx9-hr32", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-wxwm-xmx9-hr32", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, tattu_can contains an unbounded memcpy in its multi-frame assembly loop, allowing stack memory overwrite when crafted CAN frames are processed. In deployments where tattu_can is enabled and running, a CAN-injection-capable attacker can trigger a crash (DoS) and memory corruption. This vulnerability is fixed in 1.17.0-rc2."}, {"lang": "es", "value": "El piloto autom\u00e1tico PX4 es una soluci\u00f3n de control de vuelo para drones. Antes de la versi\u00f3n 1.17.0-rc2, tattu_can contiene un memcpy sin l\u00edmites en su bucle de ensamblaje de m\u00faltiples tramas, lo que permite la sobrescritura de memoria de pila cuando se procesan tramas CAN manipuladas. En implementaciones donde tattu_can est\u00e1 habilitado y en ejecuci\u00f3n, un atacante capaz de inyectar CAN puede provocar un fallo (DoS) y corrupci\u00f3n de memoria. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.17.0-rc2."}], "lastModified": "2026-03-17T16:16:23.027", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dronecode:px4_drone_autopilot:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2FC2D6F1-D77D-44C2-A99C-55CB5A4474B9", "versionEndExcluding": "1.17.0"}, {"criteria": "cpe:2.3:a:dronecode:px4_drone_autopilot:1.17.0:alpha1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "033A0A82-2986-44D5-A712-47B8D43407FF"}, {"criteria": "cpe:2.3:a:dronecode:px4_drone_autopilot:1.17.0:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F2EA96E-BC3A-42AB-B81B-53D5872B2296"}, {"criteria": "cpe:2.3:a:dronecode:px4_drone_autopilot:1.17.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1EAC5320-8D94-477D-AB85-144F8218DDFB"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}