CVE-2026-32743

PX4 is an open-source autopilot stack for drones and unmanned vehicles. Versions 1.17.0-rc2 and below are vulnerable to Stack-based Buffer Overflow through the MavlinkLogHandler, and are triggered via MAVLink log request. The LogEntry.filepath buffer is 60 bytes, but the sscanf function parses paths from the log list file with no width specifier, allowing a path longer than 60 characters to overflow the buffer. An attacker with MAVLink link access can trigger this by first creating deeply nested directories via MAVLink FTP, then requesting the log list. The flight controller MAVLink task crashes, losing telemetry and command capability and causing DoS. This issue has been fixed in this commit: https://github.com/PX4/PX4-Autopilot/commit/616b25a280e229c24d5cf12a03dbf248df89c474.

• CWE-121

• https://github.com/PX4/PX4-Autopilot/commit/616b25a280e229c24d5cf12a03dbf248df89c474Patch
• https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-97c4-68r9-96p5Exploit, Mitigation, Vendor Advisory

Published

Mar 19, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32738libheif is a HEIF and AVIF file format decoder and encoder. …6.5
• CVE-2026-32739libheif is a HEIF and AVIF file format decoder and encoder. …6.5
• CVE-2026-3274A security flaw has been discovered in Tenda F453 1.0.0.3. A…8.8
• CVE-2026-32740libheif is a HEIF and AVIF file format decoder and encoder. …8.8
• CVE-2026-32741libheif is a HEIF and AVIF file format decoder and encoder. …7.1
• CVE-2026-32742Parse Server is an open source backend that can be deployed …4.3
• CVE-2026-32745In JetBrains Datalore before 2026.1 session hijacking was po…5.7
• CVE-2026-32746telnetd in GNU inetutils through 2.7 allows an out-of-bounds…9.8
• CVE-2026-32747SiYuan is a personal knowledge management system. In version…4.9
• CVE-2026-32748Squid is a caching proxy for the Web. Prior to version 7.5, …7.5
• CVE-2026-32749SiYuan is a personal knowledge management system. In version…9.1
• CVE-2026-3275A weakness has been identified in Tenda F453 1.0.0.3. This a…8.8