PX4 vulnerabilities
We track 6 vulnerabilities in PX4 products across 2 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on September 8, 2026.
Latest PX4 vulnerabilities
- 7.1 High severity
PX4-Autopilot: Use After Free
PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the load_mon module's stop path where exit_and_cleanup() deletes the LoadMon object and frees the performance counter before perf_end() attempts to access it. Attackers can trigger this vu
- 9.8 Critical severity
Autopilot: Missing Authentication for Critical Functionality
The MAVLink communication protocol does not require cryptographic authentication by default. When MAVLink 2.0 message signing is not enabled, any message -- including SERIAL_CONTROL, which provides interactive shell access -- can be sent by an unauthenticated
- 8.0 High severity
PX4-Autopilot: Stack-based Buffer Overflow
PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, the Zenoh uORB subscriber allocates a stack VLA directly from the incoming payload length without bounds. A remote Zenoh publisher can send an oversized fragmented message to force an
- 8.1 High severity
PX4-Autopilot: Buffer Copy without Checking Size of Input
PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, The crsf_rc parser accepts an oversized variable-length known packet and copies it into a fixed 64-byte global buffer without a bounds check. In deployments where crsf_rc is enabled on
- 7.8 High severity
PX4-Autopilot: Out-of-bounds Write
A vulnerability was found in PX4 PX4-Autopilot up to 1.16.0. Affected by this issue is the function MavlinkLogHandler::state_listing/MavlinkLogHandler::log_entry_from_id of the file src/modules/mavlink/mavlink_log_handler.cpp. The manipulation results in stack
- 9.8 Critical severity
PX4-Autopilot: Out-of-bounds Write
PX4-Autopilot provides PX4 flight control solution for drones. In versions 1.14.0-rc1 and prior, PX4-Autopilot has a heap buffer overflow vulnerability in the parser function due to the absence of `parserbuf_index` value checking. A malfunction of the sensor d