Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-40427: PX4-Autopilot v1.14.3 Allows Uncontrolled Code Execution

CVE-2024-40427 · published 1 year ago

Summary

The PX4-Autopilot software has a security flaw that could allow an attacker to take control of the system. This could happen if the software is used in a critical application, such as controlling a drone. To stay safe, users should update to the latest version of the software.

What to do

Update dronecode px4_drone_autopilot to version 1.14.3 or later.

Affected software

Vendor	Product	Affected versions
dronecode	px4_drone_autopilot	< 1.14.3 `cpe:2.3:a:dronecode:px4_drone_autopilot::::::::`

Original advisory text

Stack Buffer Overflow in PX4-Autopilot v1.14.3, which allows attackers to execute commands to exploit this vulnerability and cause the program to refuse to execute

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/40xxx/CVE-2024-40427... Vendor Advisory
https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-55wq-2hgm-75m4 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-40427 Vendor Advisory
https://github.com/PX4/PX4-Autopilot/commit/e03e0261a1a0c82f545e66a1e3795956c886... Patch

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.9 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-120Classic Buffer Overflow

Timeline

Published7 Jan 2025

Updated4 Nov 2026

First seen22 Jul 2026

Sources

CVE-2024-40427 · OSV

GHSA-55wq-2hgm-75m4 · GHSA

CVE-2024-40427 · NVD

Track software like this

Free during beta