NULL Pointer Dereference in PX4 Autopilot sd_stress Command

Executive Summary

This is a NULL pointer dereference vulnerability in PX4 Autopilot versions up to 1.17.0. It affects the sd_stress command where the -b byte count parameter is parsed without validation before being passed to malloc() and memset(). Attackers with shell access, including via MAVLink, can supply invalid byte count values to crash the flight controller.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your PX4 Autopilot version is 1.17.0 or earlier. Run the sd_stress command with invalid byte count values like -1 or 1000000 to see if it crashes the system. Example: sd_stress -b -1 or sd_stress -b 1000000.

Useful 0 Not Useful 0

Impact Analysis

An attacker with shell access could exploit this to crash the flight controller, potentially causing loss of control of a drone or unmanned vehicle. This could lead to crashes, data loss, or operational failures during flight.

Useful 0 Not Useful 0

Mitigation Strategies

Update PX4 Autopilot to a version that includes the patch for CVE-2026-102808. If immediate update is not possible, restrict shell access to the system and disable MAVLink commands that could trigger the sd_stress command.

Useful 0 Not Useful 0