Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.6

PX4 Autopilot may expose internal data via long network name

CVE-2026-86714 · published 1 month ago
Summary

Versions of PX4 Autopilot up to 1.17.0 can read beyond the intended memory area when the netman command is given an interface name longer than 73 characters. This can cause parts of the system’s memory to be displayed on the console or written into network configuration files, potentially revealing sensitive information. Update to the latest PX4 release or avoid using the -i option with overly long interface names until a fix is applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
px4 px4-autopilot <= 1.17.0
Original advisory text
PX4 Autopilot through 1.17.0 Stack Buffer Over-read via netman
PX4 Autopilot through 1.17.0 contains a stack buffer over-read vulnerability in the netman system command that fails to validate interface name length. Attackers can supply interface names of 74 bytes or more via the -i option to read beyond buffer boundaries, leaking stack memory to console output or writing it into persistent network configuration files.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.6 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-125Out-of-bounds Read
Timeline
Published8 Sep 2026
Updated4 Nov 2026
First seen8 Sep 2026
Sources
CVE-2026-86714 · NVD
CVE-2026-86714 · OSV
CVE-2026-86714 · MITRE
Track software like this
Free during beta