CVE-2026-102808CWE-476

CVE-2026-102808

Medium · published September 29, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
14.7
In the wild
Unconfirmed
What it is

PX4 Autopilot through 1.17.0 contains a NULL pointer dereference vulnerability in the sd_stress command where the -b byte count parameter is parsed without validation before being passed to malloc() and memset(). Attackers with shell access, including through MAVLink, can supply invalid byte count values to crash the flight controller.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
7.1 · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00244 · 14.7th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2026-09-29T22:17Z
References (5)
https://github.com/PX4/PX4-Autopilot · [email protected]https://github.com/PX4/PX4-Autopilot/blob/d6f12ad1c4f70ad3230afd7d86e971421e02fef4/src/systemcmds/sd_stress/sd_stress.cpp#L186-L204 · [email protected]https://github.com/PX4/PX4-Autopilot/commit/c865dc9fde14d1391916775153aa271603c3c592 · [email protected]https://github.com/PX4/PX4-Autopilot/pull/28795 · [email protected]https://www.vulncheck.com/advisories/px4-autopilot-through-1.17.0-null-pointer-dereference-via-sd-stress · [email protected]
EPSS history
Timeline
  • 01 OCT 03:44Z
    EPSS moved — → 0%
    epss
  • 29 SEP 17:22Z
    PX4 Autopilot through 1.17.0 NULL Pointer Dereference via sd_stress
    cvelistv5