Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, the Zenoh uORB subscriber allocates a stack VLA directly from the incoming payload length without bounds. A remote Zenoh publisher can send an oversized fragmented message to force an unbounded stack allocation and copy, causing a stack overflow and crash of the Zenoh bridge task. This vulnerability is fixed in 1.17.0-rc2.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-32708 PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, the Zenoh uORB subscriber allocates a stack VLA directly from the incoming payload length … https://www.cve.org/CVERecord?id=CVE-2026-32708
Post summary
The post cites CVE‑2026‑32708 and gives a concise technical detail of the stack allocation flaw, but offers no PoC, exploit code, patch, or evidence of active exploitation.
4 of 4 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | dronecode | px4_drone_autopilot | - | - | - |
| App | dronecode | px4_drone_autopilot | 1.17.0 | - | - |
| App | dronecode | px4_drone_autopilot | 1.17.0 | - | - |
| App | dronecode | px4_drone_autopilot | 1.17.0 | - | - |