CVE-2026-32708: PX4 Autopilot Buffer Overflow Vulnerability

CVE-2026-32708 Overview

CVE-2026-32708 is a stack-based buffer overflow vulnerability in the PX4 autopilot flight control software for drones. The vulnerability exists in the Zenoh uORB subscriber component, which allocates a variable-length array (VLA) directly on the stack from an incoming payload length without proper bounds checking. This flaw allows a remote attacker on an adjacent network to send an oversized fragmented message that forces an unbounded stack allocation and copy operation, resulting in a stack overflow and crash of the Zenoh bridge task.

Critical Impact

Remote attackers on adjacent networks can crash drone flight control systems by sending malicious oversized Zenoh messages, potentially causing loss of drone control during flight operations.

Affected Products

• Dronecode PX4 Drone Autopilot versions prior to 1.17.0-rc2
• Dronecode PX4 Drone Autopilot 1.17.0-alpha1
• Dronecode PX4 Drone Autopilot 1.17.0-beta1
• Dronecode PX4 Drone Autopilot 1.17.0-rc1

Discovery Timeline

• 2026-03-16 - CVE-2026-32708 published to NVD
• 2026-03-17 - Last updated in NVD database

Technical Details for CVE-2026-32708

Vulnerability Analysis

The vulnerability is classified as CWE-121 (Stack-based Buffer Overflow), a memory corruption vulnerability that occurs when a buffer allocated on the stack is overwritten due to insufficient bounds checking. In the context of PX4 autopilot, the Zenoh uORB subscriber—a messaging component used for inter-process communication in robotic systems—accepts incoming payload data without validating the length parameter before allocating stack memory.

When processing incoming Zenoh messages, the subscriber uses a Variable Length Array (VLA) for temporary storage. VLAs are dynamically sized arrays allocated on the stack at runtime. The vulnerable code path allocates this VLA based directly on the attacker-controlled payload length field without enforcing maximum size constraints. An attacker can exploit this by sending specially crafted fragmented messages with artificially large length values.

Root Cause

The root cause is the absence of input validation on the payload length parameter before stack memory allocation. The Zenoh uORB subscriber trusts the incoming message length field and directly uses it to determine the size of a stack-allocated VLA. Without bounds checking, this creates a condition where an attacker can specify an arbitrarily large length value, causing the stack to overflow when the allocation exceeds available stack space.

Attack Vector

The attack requires adjacent network access, meaning the attacker must be on the same network segment as the vulnerable PX4 system. The attacker exploits the vulnerability by acting as a malicious Zenoh publisher and sending oversized fragmented messages to the target drone's Zenoh bridge.

The attack flow involves:

1. The attacker establishes a Zenoh publisher connection to the target PX4 system on an adjacent network
2. A fragmented message is crafted with an oversized length field that exceeds the normal stack allocation limits
3. When the Zenoh uORB subscriber receives this message, it attempts to allocate a VLA on the stack using the malicious length value
4. The excessive allocation causes a stack overflow, corrupting adjacent memory and crashing the Zenoh bridge task
5. This crash can disrupt flight control communications and potentially cause loss of drone control

For technical details on the exploitation mechanism, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-32708

Indicators of Compromise

• Unexpected crashes or restarts of the Zenoh bridge task on PX4 systems
• Abnormally large Zenoh message payloads observed on the network
• Memory corruption errors or stack overflow exceptions in PX4 system logs
• Unusual network traffic patterns from adjacent network devices targeting Zenoh communication ports

Detection Strategies

• Monitor PX4 system logs for stack overflow errors or unexpected Zenoh bridge task terminations
• Implement network traffic analysis to detect oversized Zenoh message fragments targeting drone systems
• Deploy intrusion detection rules to identify anomalous payload lengths in Zenoh protocol communications
• Configure SentinelOne Singularity to monitor for memory corruption indicators on systems running PX4 autopilot software

Monitoring Recommendations

• Enable verbose logging on PX4 systems to capture Zenoh communication anomalies
• Implement network segmentation monitoring to detect unauthorized adjacent network access to drone control systems
• Set up automated alerting for Zenoh bridge task crashes or restarts
• Monitor system memory usage patterns for indicators of stack exhaustion attacks

How to Mitigate CVE-2026-32708

Immediate Actions Required

• Upgrade all PX4 Drone Autopilot installations to version 1.17.0-rc2 or later immediately
• Isolate affected drone systems from untrusted adjacent networks until patches can be applied
• Review network access controls to limit which devices can communicate with drone Zenoh endpoints
• Implement network segmentation to restrict adjacent network access to critical drone control systems

Patch Information

The vulnerability has been fixed in PX4 Drone Autopilot version 1.17.0-rc2. Organizations should update their PX4 installations to this version or later to remediate the vulnerability. The security fix adds proper bounds checking to the Zenoh uORB subscriber to prevent unbounded stack allocations.

For detailed patch information and upgrade instructions, see the GitHub Security Advisory.

Workarounds

• Disable Zenoh communication functionality if not required for operations until patching is complete
• Implement strict network access controls to limit Zenoh publisher connections to trusted sources only
• Deploy network-level filtering to reject oversized Zenoh message fragments
• Use network segmentation to isolate drone control systems from potentially hostile adjacent network traffic

# Network segmentation example - restrict Zenoh communication to trusted interfaces
# Verify current PX4 version
px4 --version

# If using iptables, restrict adjacent network access to Zenoh ports
iptables -A INPUT -p udp --dport 7447 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 7447 -j DROP