CVE-2026-32708CWE-121

Zenoh uORB Subscriber Allows Arbitrary Stack Allocation (PX4/PX4-Autopilot)

High · published March 13, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
18.1
In the wild
Unconfirmed
What it is

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, the Zenoh uORB subscriber allocates a stack VLA directly from the incoming payload length without bounds. A remote Zenoh publisher can send an oversized fragmented message to force an unbounded stack allocation and copy, causing a stack overflow and crash of the Zenoh bridge task. This vulnerability is fixed in 1.17.0-rc2.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00269 · 18.1th percentile
Weakness
CWE-121 · Stack-based Buffer Overflow
Published
2026-03-13T21:18Z
EPSS history
Timeline
  • 13 MAR 21:18Z
    Zenoh uORB Subscriber Allows Arbitrary Stack Allocation (PX4/PX4-Autopilot)
    cvelistv5