Executive brief
PX4 Autopilot is flight control software used in autonomous aircraft and drones. The sd_bench command contains a heap buffer overflow vulnerability that can be triggered by specifying a block size below four bytes. An attacker with local access to the aircraft's flight computer could exploit this to crash the system or potentially execute arbitrary code, affecting the reliability and safety of the drone during flight.
Technical details
The vulnerability is a heap buffer overflow in the sd_bench command where a four-byte block number is written into a user-supplied sized allocation without proper bounds checking. The vulnerable code path is triggered when sd_bench is invoked with a block size parameter smaller than four bytes. An attacker with local command-line access to the PX4 system can trigger this overflow to corrupt heap memory, potentially achieving code execution or causing a denial of service crash. The vulnerability exists in src/systemcmds/sd_bench/sd_bench.cpp and affects PX4 Autopilot versions prior to patching; a fix should validate minimum block size requirements before the write operation.
Affected products
- PX4 Autopilot 1.17.0 and likely earlier versions
Timeline
- 2026-09-02: disclosed