CVE-2026-86714 PUBLISHED

PX4 Autopilot through 1.17.0 Stack Buffer Over-read via netman

Assigner: VulnCheck
Reserved: 08.09.2026 Published: 08.09.2026 Updated: 08.09.2026

PX4 Autopilot through 1.17.0 contains a stack buffer over-read vulnerability in the netman system command that fails to validate interface name length. Attackers can supply interface names of 74 bytes or more via the -i option to read beyond buffer boundaries, leaking stack memory to console output or writing it into persistent network configuration files.

Metrics

CVSS Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS Score: 5.3

Product Status

Vendor PX4
Product PX4-Autopilot
Versions Default: unaffected
  • affected from 0 to 1.17.0 (incl.)

Credits

  • Tianbo Wang finder
  • Xiaoyang Chen finder

References

Problem Types

  • Out-of-bounds Read CWE