Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, the BST telemetry probe writes a string terminator using a device-provided length without bounds. A malicious BST device can report an oversized dev_name_len, causing a stack overflow in the driver and crashing the task (or enabling code execution). This vulnerability is fixed in 1.17.0-rc2.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-32705 PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, the BST telemetry probe writes a string terminator using a device-provided length without … https://www.cve.org/CVERecord?id=CVE-2026-32705
Post summary
The post reveals that CVE-2026-32705 is a buffer overflow in PX4's BST telemetry probe before version 1.17.0‑rc2, but it offers no PoC, exploit, or active‑use evidence, merely disclosure details.
4 of 4 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | dronecode | px4_drone_autopilot | - | - | - |
| App | dronecode | px4_drone_autopilot | 1.17.0 | - | - |
| App | dronecode | px4_drone_autopilot | 1.17.0 | - | - |
| App | dronecode | px4_drone_autopilot | 1.17.0 | - | - |