PX4 Autopilot, a flight control solution for drones, contains a stack-based buffer overflow in the BST telemetry probe. Prior to version 1.17.0‑rc2, the driver writes a string terminator using a device‑provided length without bounds. A malicious BST device that supplies an oversized dev_name_len can trigger a stack overflow, causing the task to crash or potentially enabling arbitrary code execution. This weakness is classified as CWE‑121 and is mitigated in 1.17.0‑rc2.

Devices running PX4 Autopilot versions earlier than 1.17.0‑rc2 are affected. This includes the 1.17.0‑alpha1, beta1, and rc1 releases as indicated by the CPEs. Any deployment of these releases that accepts BST telemetry from untrusted devices is vulnerable. Upgrading to 1.17.0‑rc2 or later resolves the issue.

The CVSS score of 6.8 reflects a moderate to high severity, while an EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation yet. The attack vector, based on the description that a BST device can supply an oversized length, is inferred to be local device access or a device that can communicate with the autopilot. Due to the nature of the overflow, a successful exploit could lead to denial of service or remote code execution if the attacker can influence the device name field.