CVE-2026-84698: PX4 Autopilot sd_bench Heap Buffer Overflow via Block Size
PX4 Autopilot contains a heap buffer overflow vulnerability in the sdbench command that writes a four-byte block number into a user-supplied sized allocation. Attackers can invoke sdbench with a block size below four bytes to overflow the heap buffer and potentially execute code or crash the system.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running PX4 Autopilot where an attacker can invoke the sd_bench command are exposed. The vulnerability does not require prior privileges or user interaction according to the supplied vector.
What input is required to trigger the overflow?
An attacker must run sd_bench with a block size smaller than four bytes. The command then writes a four-byte block number into an allocation sized from that supplied block size.
What is the potential impact?
Successful exploitation can corrupt heap memory, potentially causing a system crash or enabling code execution. The provided scoring vector indicates an availability impact, while confidentiality and integrity impacts are listed as none.