CVE-2026-32708 - Vulnerability Analysis

Overview

PX4 autopilot < 1.17.0-rc2 contains a stack overflow caused by unbounded stack allocation from incoming Zenoh uORB subscriber payload length, letting remote Zenoh publishers crash the Zenoh bridge task, exploit requires sending oversized fragmented messages.

Severity & Score

Impact

Remote attackers can cause a stack overflow leading to a crash of the Zenoh bridge task, resulting in denial of service.

Mitigation

Update to version 1.17.0-rc2 or later.

References

• https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-69g4-hcqf-j45p

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 16, 2026

🟠 CVE-2026-32708 - High (7.8) PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, the Zenoh uORB subscriber allocates a stack VLA directly from the incoming payload length without bounds. A remote Zenoh publisher can send an oversized fragmented message... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32708/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner