CVE-2026-84698— PX4 Autopilot sd_bench Heap Buffer Overflow via Block Size
Quick assessment
Affected
PX4 PX4-Autopilot
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PX4 飞控（PX4 Autopilot）中存在一个堆缓冲区溢出漏洞，该漏洞位于 命令中。该命令会将一个 4 字节的块号写入一个大小由用户指定大小的内存分配区域。攻击者可以通过以小于 4 字节的块大小调用 来触发堆缓冲区溢出，从而可能实现任意代码执行或导致系统崩溃。
Possible ATT&CK Techniques 1 AI
T1531 · Account Access Removal
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-84698
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PX4 Autopilot sd_bench Heap Buffer Overflow via Block Size
Source: CVE Program / CVE List V5
Vulnerability Description
PX4 Autopilot contains a heap buffer overflow vulnerability in the sd_bench command that writes a four-byte block number into a user-supplied sized allocation. Attackers can invoke sd_bench with a block size below four bytes to overflow the heap buffer and potentially execute code or crash the system.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| PX4 | PX4-Autopilot | 0 ~ 1.17.0 | - |
|
II. Public POCs for CVE-2026-84698
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-84698
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-84698 (1)
Vendor Pages for CVE-2026-84698 (2)
Other References for CVE-2026-84698 (1)
IV. Related Vulnerabilities
Same product: PX4-Autopilot
-
CVE-2026-32743
PX4 Autopilot: Stack-based Buffer Overflow via Oversized Pat -
CVE-2026-32724
PX4 autopilot has a heap Use-After-Free in MavlinkShell::ava -
CVE-2026-32713
PX4 Autopilot MAVLink FTP Session Validation Logic Error All -
CVE-2026-32709
PX4 Autopilot MAVLink FTP Unauthenticated Path Traversal (Ar -
CVE-2026-32708
Zenoh uORB Subscriber Allows Arbitrary Stack Allocation (PX4
Same vendor: PX4
-
CVE-2026-1579
PX4 Autopilot Missing authentication for critical function -
CVE-2026-32743
PX4 Autopilot: Stack-based Buffer Overflow via Oversized Pat -
CVE-2026-32724
PX4 autopilot has a heap Use-After-Free in MavlinkShell::ava -
CVE-2026-32713
PX4 Autopilot MAVLink FTP Session Validation Logic Error All -
CVE-2026-32709
PX4 Autopilot MAVLink FTP Unauthenticated Path Traversal (Ar
Same weakness: CWE-787
-
CVE-2025-12768
FactoryTalk® Historian Machine Edition - Out-of-Bounds Write -
CVE-2026-13732
Gdb: gdb: out-of-bounds write in stabs parser read_member_fu -
CVE-2026-14368
Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON stri -
CVE-2026-82680
D-Link DSM-G600 Multipart load_file.cgi out-of-bounds write -
CVE-2026-58106
Incomplete fix for CVE-2025-40843: safe_strcpy is called wit
V. Comments for CVE-2026-84698
No comments yet