Is CVE-2026-84698 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84698 being exploited in the wild.

How severe is CVE-2026-84698?

Medium severity, with a CVSS score of 6.5, published 2 September 2026.

Which products and versions are affected?

Px4 Autopilot 1.17.0 and likely earlier versions.

Is there a fix for CVE-2026-84698?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-84698 attacked?

It is attacked with local access, in device firmware.

Am I affected by CVE-2026-84698?

Check whether you run Px4 Autopilot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84698: PX4 Autopilot heap buffer overflow in sd_bench command

CVE-2026-84698 · Severity: medium · CVSS 6.5 · Published 2026-09-02

PX4 Autopilot is flight control software used in autonomous aircraft and drones. The sd_bench command contains a heap buffer overflow vulnerability that can be triggered by specifying a block size below four bytes. An attacker with local access to the aircraft's flight computer could exploit this to crash the system or potentially execute arbitrary code, affecting the reliability and safety of the drone during flight.

Technologies: Px4 Autopilot. Vendors: Px4.

Quick answers

Is CVE-2026-84698 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84698 being exploited in the wild.
How severe is CVE-2026-84698?: Medium severity, with a CVSS score of 6.5, published 2 September 2026.
Which products and versions are affected?: Px4 Autopilot 1.17.0 and likely earlier versions.
Is there a fix for CVE-2026-84698?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-84698 attacked?: It is attacked with local access, in device firmware.
Am I affected by CVE-2026-84698?: Check whether you run Px4 Autopilot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a heap buffer overflow in the sd_bench command where a four-byte block number is written into a user-supplied sized allocation without proper bounds checking. The vulnerable code path is triggered when sd_bench is invoked with a block size parameter smaller than four bytes. An attacker with local command-line access to the PX4 system can trigger this overflow to corrupt heap memory, potentially achieving code execution or causing a denial of service crash. The vulnerability exists in src/systemcmds/sd_bench/sd_bench.cpp and affects PX4 Autopilot versions prior to patching; a fix should validate minimum block size requirements before the write operation.

Affected products

PX4 Autopilot 1.17.0 and likely earlier versions

Timeline

2026-09-02: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.