CVE-2026-86714: PX4 Autopilot Buffer Overflow Vulnerability

CVE-2026-86714 Overview

CVE-2026-86714 is a stack buffer over-read vulnerability in PX4 Autopilot through version 1.17.0. The flaw resides in the netman system command, which fails to validate the length of user-supplied interface names. Attackers with adjacent network access can supply an interface name of 74 bytes or more via the -i option to read beyond stack buffer boundaries. The leaked memory is exposed to console output or written into persistent network configuration files. The vulnerability is classified as [CWE-125] Out-of-Bounds Read and affects PX4-based unmanned aerial vehicles and autopilot systems.

Critical Impact
Adjacent attackers can leak stack memory contents through the netman command, potentially exposing sensitive runtime data and persisting it into network configuration files.

Affected Products

PX4 Autopilot versions through 1.17.0
The netman system command component (src/systemcmds/netman/netman.cpp)
Downstream PX4-based flight controller firmware builds

Discovery Timeline

2026-09-08 - CVE-2026-86714 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86714

Vulnerability Analysis

The vulnerability exists in the netman system command in PX4 Autopilot. This command manages network interface configuration on flight controllers. When invoked with the -i option, netman accepts an interface name from the caller and copies it into a fixed-size stack buffer. The code path performs no bounds check against the buffer capacity.

Supplying an interface name of 74 bytes or more causes the routine to read memory beyond the buffer boundary. The over-read contents are then emitted to console output or serialized into the persistent network configuration file at /net.cfg. This provides two viable exfiltration channels for the leaked stack data.

Because the leaked bytes originate from stack memory adjacent to the buffer, they may contain return addresses, saved registers, or transient runtime values. Attackers can use the disclosure to defeat address space layout randomization or to inform follow-on exploitation of the flight controller.

Root Cause

The root cause is missing input length validation on the interface name argument in netman.cpp. The patch introduces #include <net/if.h> so the code can validate against the standard IFNAMSIZ limit before copying user data. Prior to the fix, no upper bound was enforced on the -i argument length.

Attack Vector

Exploitation requires the ability to invoke the netman command with attacker-controlled arguments. This is typically reachable via the PX4 shell (nsh) exposed over an adjacent network interface such as MAVLink shell, telemetry link, or a management console on the same network segment. No authentication or user interaction is required per the CVSS vector.

cpp

// Patch: src/systemcmds/netman/netman.cpp
 #include <px4_platform_common/log.h>
 #include <arpa/inet.h>
 #include <px4_platform_common/shutdown.h>
+#include <net/if.h>
 
 constexpr char DEFAULT_NETMAN_CONFIG[] = CONFIG_BOARD_ROOT_PATH "/net.cfg";
 #if defined(CONFIG_NETINIT_DHCPC)
// Source: https://github.com/PX4/PX4-Autopilot/commit/fec216e9d716d96d93b9d882b0c9cf00db3c6810

The committed patch adds the <net/if.h> header so that the interface name argument can be validated against the platform-defined IFNAMSIZ constant before being copied.

Detection Methods for CVE-2026-86714

Indicators of Compromise

Unusually long interface name strings appearing in PX4 console logs or MAVLink shell history
Modifications to the /net.cfg file containing non-printable bytes or values exceeding the expected interface name length
Unexpected invocations of the netman -i command originating from adjacent network sources

Detection Strategies

Inspect PX4 console output and MAVLink shell transcripts for netman invocations with -i arguments longer than 15 bytes (the standard IFNAMSIZ minus null terminator)
Compare deployed firmware version strings against 1.17.0 to enumerate exposure across a fleet
Monitor telemetry links for unauthenticated shell traffic that could reach the netman command

Monitoring Recommendations

Baseline the contents and hash of /net.cfg on trusted units and alert on unexpected changes
Log all nsh command invocations reaching flight controllers over telemetry or ground control links
Restrict and monitor ground control station access to network segments carrying MAVLink or serial-over-IP traffic to autopilots

How to Mitigate CVE-2026-86714

Immediate Actions Required

Upgrade PX4 Autopilot to a firmware build containing commit fec216e9d716d96d93b9d882b0c9cf00db3c6810 from Pull Request #28483
Disable or firewall MAVLink shell and remote nsh access on production flight controllers
Audit /net.cfg on all deployed units and restore known-good network configuration where tampering is suspected

Patch Information

The fix is committed in the PX4 Autopilot repository as commit fec216e9. Additional context is available in the VulnCheck Advisory for PX4 and the Netman Source Code at tag v1.17.0.

Workarounds

Remove or disable the netman module from the firmware build configuration if network configuration management is not required
Restrict access to the PX4 shell so that untrusted operators cannot invoke netman with the -i option
Segment autopilot management networks so only authenticated ground control stations can reach the flight controller

bash

# Verify the deployed PX4 firmware version and check for the fix commit
px4 --version
git -C PX4-Autopilot log --oneline | grep fec216e9
# If the commit is absent, rebuild from a branch that includes PR #28483