CVE-2026-102808
PX4 Autopilot through 1.17.0 NULL Pointer Dereference via sd_stress
- State
- Published
- Severity
- 7.1 High
- Published
- Sep 29, 2026
- Updated
- Oct 2, 2026
- Reserved
- Sep 29, 2026
Description
PX4 Autopilot through 1.17.0 contains a NULL pointer dereference vulnerability in the sd_stress command where the -b byte count parameter is parsed without validation before being passed to malloc() and memset(). Attackers with shell access, including through MAVLink, can supply invalid byte count values to crash the flight controller.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-476 NULL Pointer Dereference
Affected Products
| Product | Versions |
|---|---|
PX4-AutopilotPX4 |
|
References
- Pull Request #28795issue-trackingpatch
- Patch Commitpatch
- https://github.com/PX4/PX4-Autopilot/blob/d6f12ad1c4f70ad3230afd7d86e971421e02fef4/src/systemcmds/sd_stress/sd_stress.cpp#L186-L204technical-description
- https://github.com/PX4/PX4-Autopilotproduct
- VulnCheck Advisory: PX4 Autopilot through 1.17.0 NULL Pointer Dereference via sd_stressthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.