CVE-2026-84698

PX4 Autopilot, an open-source flight-control stack used on many drone and unmanned-vehicle flight controllers, contains a heap buffer overflow (CWE-787) in its sd_bench storage-benchmark command. The command writes a four-byte block number into a heap allocation sized from a user-supplied block size, so invoking sd_bench with a block size below four bytes causes an out-of-bounds write past the end of the buffer. An attacker who can invoke the command - typically through the PX4 console or MAVLink shell reachable over an adjacent network or companion-computer link - could corrupt heap memory and potentially execute code or crash the flight controller, with the CVSS 4.0 score weighting high availability impact on the vulnerable component. Anyone running PX4-based firmware whose command console or shell can be reached by another system is affected; the source data names no other products or version ranges. No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is known, and EPSS estimates only about a 0.3% probability of exploitation within 30 days.

What to do: Inventory which aircraft and companion systems run PX4-based firmware and upgrade to a PX4 release containing the sd_bench fix as directed by the PX4 advisory (no fixed version number is provided in the source data). Until patching, restrict access to the PX4 console/MAVLink shell to trusted companion computers and telemetry links, and avoid running sd_bench with block sizes below four bytes. Given no known PoC or in-the-wild exploitation, routine patch cadence is reasonable.