CVE-2026-32707

PX4 autopilot has a stack buffer overflow in tattu_can due to unbounded memcpy in frame assembly loop

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, tattu_can contains an unbounded memcpy in its multi-frame assembly loop, allowing stack memory overwrite when crafted CAN frames are processed. In deployments where tattu_can is enabled and running, a CAN-injection-capable attacker can trigger a crash (DoS) and memory corruption. This vulnerability is fixed in 1.17.0-rc2.

Affected

PX4 · PX4-Autopilot

CVSS v3.1 NVD

6.1 MEDIUMCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CVSS v3.1 GITHUB

5.2 MEDIUMCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

EPSS

0.28% chance of exploitation in the next 30 days, 19th percentile

Published

2026-03-13

Updated

2026-03-17

Proof-of-concept exploits (1)

• mbanyamer/CVE-2026-32707-PX4-Autopilot-tattu_can-Stack-Buffer-Overflow-DoS-0★ · 2026-05-08

Security advisories

• PX4/PX4-Autopilot/security/advisories/GHSA-wxwm-xmx9-hr32

References

• CVE Record
• NVD entry

Related

• CVE-2019-7711
• CVE-2021-41579
• CVE-2023-31059
• CVE-2025-24076
• CVE-2025-24813
• CVE-2025-30397