Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-32708 is a high-severity stack-based buffer overflow vulnerability in the Zenoh uORB subscriber component of the PX4 autopilot system for drones. The issue occurs because the code allocates a variable-length array (VLA) on the stack based directly on the length of an incoming payload without enforcing any maximum size limit.'}, {'type': 'paragraph', 'content': "When a remote Zenoh publisher sends an oversized fragmented message, the code allocates a stack buffer larger than the thread's stack size, causing a stack overflow. This overflow corrupts adjacent stack frames and crashes the Zenoh bridge task."}, {'type': 'paragraph', 'content': 'The vulnerability is exploitable remotely by any Zenoh publisher on the network, requires low privileges, and no user interaction. It can lead to confidentiality, integrity, and availability loss, and potentially remote code execution if stack protections are weak.'}] [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a stack overflow that crashes the Zenoh bridge task, leading to denial of service and loss of availability of the PX4 autopilot system.

Because the vulnerability affects confidentiality and integrity as well, an attacker might exploit it to execute arbitrary code remotely, potentially gaining control over the affected system or accessing sensitive data.

The exploit requires only low privileges and no user interaction, making it easier for attackers to leverage this vulnerability remotely.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a stack-based buffer overflow in the Zenoh uORB subscriber component of PX4 autopilot, triggered by receiving an oversized fragmented message from a remote Zenoh publisher.

Detection can focus on monitoring for crashes or abnormal behavior of the Zenoh bridge task, especially stack overflow crashes.

Since the vulnerability is triggered by receiving oversized fragmented messages, network monitoring for unusually large or fragmented Zenoh protocol messages could help detect attempts.

No specific commands are provided in the resources, but general approaches include:

• Using system logs or crash reports to identify Zenoh bridge task crashes.
• Using network packet capture tools (e.g., tcpdump or Wireshark) to filter and analyze Zenoh protocol traffic for oversized fragmented messages.
• Employing AddressSanitizer (ASAN) or similar runtime memory error detectors during testing to catch stack overflow events at the vulnerable allocation point.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade the PX4 autopilot software to version 1.17.0-rc2 or later, where the vulnerability is fixed.

Until the upgrade can be applied, consider restricting network access to the Zenoh publisher interface to trusted sources only, to prevent remote attackers from sending malicious oversized fragmented messages.

Monitoring and alerting on Zenoh bridge task crashes can help detect exploitation attempts and prompt immediate response.

Useful 0 Not Useful 0