CVE-2026-32706: PX4 autopilot has a global buffer overflow in crsf_rc via oversized variable-length known packet
PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, The crsfrc parser accepts an oversized variable-length known packet and copies it into a fixed 64-byte global buffer without a bounds check. In deployments where crsfrc is enabled on a CRSF serial port, an adjacent/raw-serial attacker can trigger memory corruption and crash PX4. This vulnerability is fixed in 1.17.0-rc2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32706?
CVE-2026-32706 has been classified as a critical vulnerability due to its potential for remote code execution via the buffer overflow.
How do I fix CVE-2026-32706?
To mitigate CVE-2026-32706, update the PX4 autopilot software to version 1.17.0-rc2 or later.
What software versions are affected by CVE-2026-32706?
CVE-2026-32706 affects all versions of PX4 autopilot prior to 1.17.0-rc2.
What type of vulnerability is CVE-2026-32706?
CVE-2026-32706 is a global buffer overflow vulnerability found in the crsf_rc parser of the PX4 autopilot.
What are the potential impacts of CVE-2026-32706?
The impacts of CVE-2026-32706 could include unauthorized access to the drone's control system and potential takeovers.