CVE-2025-15150

Medium

Description

A vulnerability was found in PX4 PX4-Autopilot up to 1.16.0. Affected by this issue is the function MavlinkLogHandler::state_listing/MavlinkLogHandler::log_entry_from_id of the file src/modules/mavlink/mavlink_log_handler.cpp. The manipulation results in stack-based buffer overflow. The attack is only possible with local access. The patch is identified as 338595edd1d235efd885fd5e9f45e7f9dcf4013d. It is best practice to apply a patch to resolve this issue.

SeverityMedium

CVSS5.3

Exploit probability—

ProductDronecode Px4 Drone Autopilot

PublishedDec 28, 2025

First seenDec 28, 2025

Weakness typeCWE-121CWE-121 CWE-119Memory buffer bounds error

How to fix

Patches

github.com/PX4/PX4-Autopilot/pull/26124/commits/338595edd1d235efd885fd5e9f45e7f9dcf4013d

Affected products

Product	Affected versions	Fixed in
dronecode px4_drone_autopilot	v ≤ 1.16.0	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.