PX4 autopilot contains a global buffer overflow in the crsf_rc parser. An oversized variable‑length known packet is accepted and copied into a fixed 64‑byte global buffer without bounds checking. The overflow corrupts adjacent memory or triggers a crash, resulting in denial of service. The weakness is classified as CWE‑120 (Buffer Copy without Checking Size of Destination Buffer) and CWE‑787 (Out‑of‑Bounds Write).

The vulnerability exists in PX4 Autopilot firmware versions prior to 1.17.0‑rc2, including releases 1.17.0‑alpha1, 1.17.0‑beta1, and 1.17.0‑rc1. It affects any deployment where the crsf_rc feature is enabled over a CRSF serial port and an adjacent or raw‑serial channel is reachable by an attacker.

The CVSS base score is 7.1, indicating moderate to high severity. EPSS is below 1%, suggesting a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to send crafted packets over the CRSF serial interface, typically a local or physically accessible channel, to trigger the overflow. Successful exploitation would cause the PX4 firmware to crash or reboot, leading to loss of vehicle control and availability. There is no evidence of confirmed code execution, so the primary impact is denial of service and potential loss of mission safety.