CVE-2026-86714

Medium

Description

PX4 Autopilot through 1.17.0 contains a stack buffer over-read vulnerability in the netman system command that fails to validate interface name length. Attackers can supply interface names of 74 bytes or more via the -i option to read beyond buffer boundaries, leaking stack memory to console output or writing it into persistent network configuration files.

SeverityMedium

CVSS5.4

Exploit probability—

ProductPX4-Autopilot

PublishedSep 8, 2026

First seenSep 8, 2026

Weakness typeCWE-125Out-of-bounds read

How to fix

Patches

github.com/PX4/PX4-Autopilot/pull/28483
github.com/PX4/PX4-Autopilot/commit/fec216e9d716d96d93b9d882b0c9cf00db3c6810

Affected products

Product	Affected versions	Fixed in
PX4 PX4-Autopilot	v ≤ 1.17.0	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.