Executive brief
PX4 Autopilot is flight control software used on unmanned aerial vehicles and robotics platforms to manage autonomous navigation and operations. A null pointer dereference vulnerability allows an attacker to crash the autopilot process by executing specific commands without proper arguments, potentially disrupting vehicle operation or mission-critical functions.
Technical details
A null pointer dereference vulnerability exists in the param_set_default_file() and param_set_backup_file() functions in PX4 Autopilot. The vulnerability is triggered when the 'param select' or 'param select-backup' commands are invoked from the PX4 shell without providing a required path argument, causing the functions to dereference a null pointer. An attacker with shell access can exploit this to crash the autopilot process, resulting in denial of service. The vulnerability affects versions through 1.17.0; patch status for newer versions is not specified in available information.
Affected products
- PX4 Autopilot through 1.17.0
Timeline
- 2026-09-04: disclosed