CVE-2026-102809: PX4 Autopilot Buffer Overflow Vulnerability

CVE-2026-102809 Overview

CVE-2026-102809 is an uncontrolled stack allocation vulnerability [CWE-789] in PX4 Autopilot through version 1.17.0. The flaw resides in the file2 test command, which fails to validate the write chunk size parameter supplied through the -c option. An attacker with shell access to the flight controller can pass an excessively large value to trigger a stack overflow. The resulting condition crashes the flight controller process and disrupts autopilot availability. PX4 Autopilot is an open-source flight control stack widely deployed on unmanned aerial vehicles, ground vehicles, and other autonomous platforms.

Critical Impact
Attackers with shell access can crash the PX4 flight controller by supplying an oversized chunk size to the file2 test command, causing a denial of service on the autopilot.

Affected Products

PX4 Autopilot versions up to and including 1.17.0
PX4 systemcmds/tests/test_file2.c component
Flight controllers and vehicles running vulnerable PX4 firmware builds

Discovery Timeline

2026-09-29 - CVE-2026-102809 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-102809

Vulnerability Analysis

The defect lives in the test_file2 self-test routine shipped in PX4's systemcmds module. The command accepts a -c flag that controls the size of the write buffer used during file I/O testing. The routine allocates that buffer on the stack without bounding the requested size against available stack space. Supplying a large integer via -c causes the allocation to exceed the task stack, corrupting adjacent memory or triggering an immediate fault.

Because PX4 tasks run with fixed, relatively small stacks on the target microcontroller, even moderately oversized requests can exhaust the stack. The result is a crash of the flight controller, interrupting autopilot control loops. Exploitation requires shell access to the NuttX shell (nsh) or MAVLink shell, so the attacker must already have a path to the command interface exposed by the vehicle.

Root Cause

The root cause is missing input validation on the -c argument prior to a stack allocation. The vulnerable code path in src/systemcmds/tests/test_file2.c (lines 86-130) trusts the user-supplied chunk size and uses it to size a stack buffer. This matches the CWE-789: Memory Allocation with Excessive Size Value pattern.

Attack Vector

Exploitation is local to the flight controller shell. An attacker who reaches the nsh prompt over UART, USB, or a MAVLink shell channel can invoke the tests file2 command with an oversized -c value. The autopilot task crashes, producing a denial-of-service condition. There is no confidentiality or integrity impact, but availability of the flight control stack is directly affected. For technical detail, see the PX4 test file source code and the VulnCheck advisory.

Detection Methods for CVE-2026-102809

Indicators of Compromise

Unexpected invocations of the tests file2 command on the PX4 shell, especially with large -c values.
Sudden PX4 task crashes, watchdog resets, or unexplained flight controller reboots during operation.
MAVLink shell sessions from unknown or unauthorized ground control stations.

Detection Strategies

Audit PX4 firmware builds to confirm whether the test_file2 command is compiled in for production images.
Log and review all commands issued through nsh and MAVLink shell channels for occurrences of tests file2 -c.
Monitor autopilot logs and ULog files for abnormal task termination or stack-overflow diagnostics.

Monitoring Recommendations

Alert on any shell access to flight controllers outside of authorized maintenance windows.
Track firmware version inventory and flag vehicles running PX4 1.17.0 or earlier.
Correlate MAVLink telemetry with ground station identity to surface unexpected shell traffic.

How to Mitigate CVE-2026-102809

Immediate Actions Required

Upgrade PX4 Autopilot to a build that includes the fix from PX4 commit 46a77d8.
Disable or remove the tests system commands from production firmware builds where self-tests are not required.
Restrict physical and network access to the flight controller shell, including USB, UART, and MAVLink shell endpoints.

Patch Information

The upstream fix is tracked in PX4 Pull Request #28586 and merged in commit 46a77d8ad15e7929ef261c41083dffd1bbfa9f85. Operators should rebuild firmware from a branch containing this commit and reflash affected vehicles. See the PX4 Autopilot repository for release status.

Workarounds

Compile PX4 firmware without the test_file2 system command until the patched release is deployed.
Enforce authentication and physical controls on any interface that exposes the nsh prompt.
Disable MAVLink shell forwarding on production vehicles to prevent remote invocation of test commands.

bash

# Configuration example: exclude PX4 test commands from a firmware build
# In the board configuration (e.g., boards/<vendor>/<board>/default.px4board),
# ensure the tests module is not enabled:
#
#   CONFIG_SYSTEMCMDS_TESTS=n
#
# Then rebuild and flash the target:
make <vendor>_<board>_default
make <vendor>_<board>_default upload