6.8medium
SecMateSECMATE-2025-0027
VendorPX4
ProductPX4-Autopilot
VectorCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AdvisoryGHSA-79mp-34pp-2f3f
Timeline
Published
Mar 13, 2026
Summary
A stack buffer overflow exists in the PX4 BST telemetry driver. The driver processes a device info reply without validating the dev_name_len parameter, writing a null terminator at an attacker-controlled offset. Since the dev_name buffer is only 32 bytes and the length is unchecked, a malicious BST device can report an oversized dev_name_len, causing a stack overflow in the driver and crashing the task or enabling code execution.