CVE-2026-102809
Received Received - Intake

Uncontrolled Stack Allocation in PX4 Autopilot

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: VulnCheck

Description
PX4 Autopilot through 1.17.0 contains an uncontrolled stack allocation vulnerability in the file2 test command that fails to validate the write chunk size parameter. Attackers with shell access can supply an excessively large value to the -c option to trigger stack overflow and crash the flight controller.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-29
Last Modified
2026-09-29
Generated
2026-09-29
AI Q&A
2026-09-29
EPSS Evaluated
N/A
NVD
CVE-2026-102809
EUVD
EUVD-2026-89109

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
px4 autopilot 1.17.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-102809 is a stack-based buffer overflow in PX4 Autopilot versions up to 1.17.0. It occurs in the file2 test command when parsing the -c option. Attackers with shell access can provide an excessively large value for the write chunk size, causing a stack overflow and crashing the flight controller. The issue stems from unvalidated input used for stack-allocated variable-length arrays.

Detection Guidance

To detect this vulnerability, check if the SYSTEMCMDS_TESTS module is enabled in your PX4 Autopilot firmware. If enabled, attempt to run the vulnerable command: tests file2 -c 10000000. If the system crashes or shows stack overflow errors, the vulnerability is present.

Impact Analysis

If exploited, this vulnerability can crash the flight controller, leading to a denial of service. The impact is limited because the affected module is typically disabled in production firmware. However, if enabled, an attacker could cause system instability or crashes during flight operations.

Mitigation Strategies

Immediately disable the SYSTEMCMDS_TESTS module in your PX4 Autopilot firmware if it is enabled. Update to the latest version of PX4 Autopilot that includes the fix for CVE-2026-102809, which adds input validation for the -c option in the file2 test command.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102809. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart