CVE-2026-32707: PX4 autopilot has a stack buffer overflow in tattu_can due to unbounded memcpy in frame assembly loop
PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, tattucan contains an unbounded memcpy in its multi-frame assembly loop, allowing stack memory overwrite when crafted CAN frames are processed. In deployments where tattucan is enabled and running, a CAN-injection-capable attacker can trigger a crash (DoS) and memory corruption. This vulnerability is fixed in 1.17.0-rc2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32707?
The severity of CVE-2026-32707 is considered high due to the potential for stack memory overwrite.
How do I fix CVE-2026-32707?
To fix CVE-2026-32707, update to the latest version of PX4 autopilot, above 1.17.0-rc2.
What is the impact of CVE-2026-32707?
CVE-2026-32707 can lead to system instability and unauthorized access due to a stack buffer overflow.
Which versions of PX4 autopilot are affected by CVE-2026-32707?
Versions of PX4 autopilot prior to 1.17.0-rc2 are affected by CVE-2026-32707.
What is the cause of CVE-2026-32707?
CVE-2026-32707 is caused by an unbounded memcpy in the multi-frame assembly loop of the tattu_can module.