Skip to main content
Disclosures

PX4 · PX4-Autopilot

BST Device Name Length Can Overflow Driver Buffer

6.8medium
SecMateSECMATE-2025-0027
VendorPX4
ProductPX4-Autopilot
VectorCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Timeline
Published
Mar 13, 2026
Summary

A stack buffer overflow exists in the PX4 BST telemetry driver. The driver processes a device info reply without validating the dev_name_len parameter, writing a null terminator at an attacker-controlled offset. Since the dev_name buffer is only 32 bytes and the length is unchecked, a malicious BST device can report an oversized dev_name_len, causing a stack overflow in the driver and crashing the task or enabling code execution.

What's hidden in yours?

Find out