CVE-2026-84698: PX4 Autopilot Buffer Overflow Vulnerability

CVE-2026-84698 Overview

CVE-2026-84698 is a heap buffer overflow vulnerability [CWE-787] in PX4 Autopilot, an open-source flight control software widely used in unmanned aerial vehicles and other autonomous systems. The flaw resides in the sd_bench system command, which writes a four-byte block number into a heap buffer whose size is controlled by user input. When an attacker invokes sd_bench with a block size below four bytes, the write operation exceeds the allocated buffer boundary.

The vulnerability allows attackers with adjacent network access to corrupt heap memory. Successful exploitation can crash the autopilot or potentially enable code execution on the flight controller.

Critical Impact
Heap corruption in flight-critical software can cause system crashes mid-flight, resulting in loss of vehicle control or arbitrary code execution on the autopilot.

Affected Products

PX4 Autopilot flight control software
PX4 Autopilot v1.17.0 (confirmed vulnerable source reference)
Systems and vehicles running PX4-based firmware exposing the sd_bench command

Discovery Timeline

2026-09-02 - CVE-2026-84698 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84698

Vulnerability Analysis

The defect lives in src/systemcmds/sd_bench/sd_bench.cpp, the SD card benchmarking utility shipped with PX4 Autopilot. The command accepts a user-supplied block size argument and allocates a heap buffer of that size. Before writing benchmark data, the code writes a four-byte block number as a header into the buffer.

The allocation size is not validated against the minimum size required for the header write. When the caller passes a block size of one, two, or three bytes, the four-byte write extends past the end of the allocation. This produces an out-of-bounds write into adjacent heap memory, corrupting metadata or neighboring objects on the heap.

The impact profile focuses on availability. Heap corruption typically crashes the autopilot process, but adversaries who can shape the heap layout may steer the overflow toward function pointers or control structures for code execution.

Root Cause

The root cause is missing input validation on the block size parameter passed to sd_bench. The code assumes the caller provides a buffer large enough to hold the four-byte block number header. No bounds check enforces block_size >= sizeof(uint32_t) before the write occurs, producing a classic write-what-where primitive constrained to a four-byte overflow.

Attack Vector

Exploitation requires the ability to invoke shell commands on the PX4 autopilot. This is available through adjacent network channels such as the MAVLink shell, a serial console, or telemetry links that expose the NuttX shell. An attacker on the vehicle's control network issues sd_bench with a block size below four bytes to trigger the overflow. See the VulnCheck advisory and GitHub Issue #28373 for reproduction context.

Detection Methods for CVE-2026-84698

Indicators of Compromise

Invocations of the sd_bench command with a --bs or block size argument smaller than four bytes in shell logs or MAVLink command history.
Unexpected autopilot restarts, watchdog resets, or NuttX kernel panics correlated with SD benchmarking activity.
Anomalous MAVLink shell traffic originating from ground control stations or telemetry endpoints not authorized to issue diagnostic commands.

Detection Strategies

Instrument PX4 shell command logging to capture the full argument list of sd_bench invocations and alert on undersized block size values.
Correlate flight controller crash dumps with recent shell commands to identify heap corruption triggered by benchmarking utilities.
Baseline normal MAVLink command traffic and flag diagnostic subcommands issued outside maintenance windows.

Monitoring Recommendations

Forward autopilot syslog and MAVLink command telemetry to a central logging platform for retention and analysis.
Monitor ground control station audit trails for use of shell passthrough features against production vehicles.
Track firmware versions across the fleet to identify systems still running vulnerable PX4 builds referenced in the PX4 Autopilot repository.

How to Mitigate CVE-2026-84698

Immediate Actions Required

Restrict access to the MAVLink shell and any serial or network channel that exposes the NuttX command line on production vehicles.
Disable or remove the sd_bench command from production firmware builds where SD benchmarking is not required.
Enforce authentication and link-layer encryption on telemetry radios and companion computer interfaces used to reach the autopilot.

Patch Information

At the time of publication, refer to the PX4 Autopilot repository and GitHub Issue #28373 for the latest fix status. The vulnerable code path is in sd_bench.cpp and should be corrected by validating that the requested block size is at least sizeof(uint32_t) before the block-number write.

Workarounds

Rebuild PX4 firmware with sd_bench excluded from the systemcmds module list when the benchmark utility is not operationally necessary.
Apply a local patch that rejects block sizes below four bytes and returns an error to the caller.
Segment vehicle control networks to prevent adjacent attackers from reaching the MAVLink shell interface.

bash

# Configuration example: exclude sd_bench from a PX4 build
# Edit the board configuration and remove the module from systemcmds
# boards/<vendor>/<board>/default.px4board
# Comment out or delete:
# CONFIG_SYSTEMCMDS_SD_BENCH=y