CVE-2026-32707 - PX4-Autopilot tattu_can Stack Buffer Overflow (DoS)

╔════════════════════════════════════════════════════════════════════════════════════════════╗
║                                                                                            ║
║   ██████╗  █████╗ ███╗   ██╗██╗   ██╗ █████╗ ███╗   ███╗███████╗██████╗                     ║
║   ██╔══██╗██╔══██╗████╗  ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██╗                    ║
║   ██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗  ██████╔╝                    ║
║   ██╔══██╗██╔══██║██║╚██╗██║  ╚██╔╝  ██╔══██║██║╚██╔╝██║██╔══╝  ██╔══██╗                    ║
║   ██████╔╝██║  ██║██║ ╚████║   ██║   ██║  ██║██║ ╚═╝ ██║███████╗██║  ██║                    ║
║   ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═══╝   ╚═╝   ╚═╝  ╚═╝╚═╝     ╚═╝╚══════╝╚═╝  ╚═╝                    ║
║                                                                                            ║
║                         [ b a n y a m e r _ s e c u r i t y ]                              ║
║                                                                                            ║
║                  ▸ Silent Hunter  |  Shadow Presence  |  Digital Intel ◂                  ║
║                                                                                            ║
║   Operator : Mohammed Idrees Banyamer  •  Jordan 🇯🇴                                       ║
║   Handle   : @banyamer_security                                                           ║
║                                                                                            ║
╚════════════════════════════════════════════════════════════════════════════════════════════╝

Description

This repository contains a proof‑of‑concept (PoC) exploit for CVE‑2026‑32707, a stack‑based buffer overflow in the tattu_can driver of the PX4‑Autopilot flight controller firmware (versions ≤ 1.17.0‑rc1). The vulnerability resides in the multi‑frame message assembly routine: when reassembling a Tattu12SBatteryMessage structure on the stack, the driver performs unbounded memcpy() operations without checking the cumulative offset against the buffer size (48 bytes). An attacker with the ability to inject CAN frames into the same bus can trigger the overflow, causing a stack corruption and subsequent crash (Denial of Service) of the PX4 process.

Attack Flow Diagram

sequenceDiagram
    participant Attacker as Attacker (CAN Node)
    participant CANbus as CAN Bus
    participant PX4 as PX4 Autopilot (tattu_can)
    
    Attacker->>CANbus: 1. Start frame (DLC=8, data[7]=0x80)
    CANbus->>PX4: Start-of-transfer received
    PX4->>PX4: tattu_message buffer (48 bytes)<br/>Copy offset=5 bytes
    
    loop Overflow frames (7x)
        Attacker->>CANbus: Overflow frame (DLC=8, payload 7 bytes)
        CANbus->>PX4: memcpy(dest+offset, payload, 7)
        PX4->>PX4: offset += 7
    end
    
    Attacker->>CANbus: Final overflow frame (DLC=8)
    CANbus->>PX4: memcpy(dest+offset, payload, 7)
    PX4->>PX4: offset > 48 → STACK OVERFLOW
    PX4-->>PX4: Crash (segfault / hard fault)
    Note over PX4: Denial of Service

Vulnerable & Fixed Versions

Affected: PX4‑Autopilot versions ≤ 1.17.0‑rc1 with tattu_can driver enabled
Fixed: PX4‑Autopilot ≥ 1.17.0‑rc2 (commit 3f04b7a)

Requirements

Python 3 with python-can library
Linux with SocketCAN support (most distributions)
Root privileges (CAP_NET_RAW) to send raw CAN frames
A CAN interface (physical can0 or virtual vcan0)

Installation

# Clone the repository
git clone https://github.com/mbanyamer/CVE-2026-32707-PoC.git
cd CVE-2026-32707-PoC

# Install python-can
pip3 install python-can

# (Optional) Create a virtual CAN interface for testing
sudo ip link add dev vcan0 type vcan
sudo ip link set up vcan0

Usage

sudo python3 exploit.py <can_interface>

Example

# Exploit via virtual CAN interface (for simulation/testing)
sudo python3 exploit.py vcan0

# Exploit via physical CAN bus
sudo python3 exploit.py can0

How the Exploit Works

Start‑of‑transfer frame – The first CAN frame (DLC=8) has its last byte set to 0x80, which signals the driver to begin assembling a new Tattu12SBatteryMessage and copies the first 5 bytes into the stack buffer.
Overflow frames – Seven subsequent CAN frames (each DLC=8) are sent. The driver copies 7 bytes per frame (DLC‑1) into the buffer starting at offset 5. After the 7th frame, the cumulative offset exceeds 48 bytes.
Final trigger – An extra frame triggers the last memcpy() that writes past the buffer boundary, corrupting the stack frame.
Result – The PX4 process crashes (segmentation fault or hard fault). On a real flight controller, this leads to a denial of service (loss of control).

Expected Output

[*] Sending start-of-transfer frame on vcan0 (can_id=0x00000123)
[*] Sending 7 overflow frames (each copies 7 bytes)...
[*] Sending final overflow frame...
[+] Attack sequence completed. The PX4 tattu_can driver should now crash.

Mitigation

Update PX4‑Autopilot to version 1.17.0‑rc2 or later.
Disable the tattu_can driver if not required (tattu_can stop or remove from build).
Apply patch manually (bounds check added in commit 3f04b7a):

while (receive(&received_frame) > 0) {
+   if (received_frame.payload_size == 0) {
+       break;
+   }
    size_t payload_size = received_frame.payload_size - 1;
-   // TODO: add check ...
+   if (offset + payload_size > sizeof(tattu_message)) {
+       break;
+   }
    memcpy(((char *)&tattu_message) + offset, received_frame.payload, payload_size);
    offset += payload_size;
}

References

Credits

Discoverer & PoC Author – Mohammed Idrees Banyamer
Country – Jordan 🇯🇴
Instagram – @banyamer_security
GitHub – mbanyamer

Disclaimer

This proof‑of‑concept is provided for educational and security testing purposes only. Use it only on systems you own or have explicit permission to test. The author is not responsible for any misuse or damage caused by this code.

Most Popular

CVE-2026-32707-PX4-Autopilot-tattu_can-Stack-Buffer-Overflow-DoS-