PX4 Autopilot contains an unbounded memcpy in the tattu_can component’s multi‑frame assembly loop, causing a stack buffer overflow. When the driver processes crafted CAN frames, the overflow can overwrite adjacent stack data, leading to a crash (Denial of Service) and potential memory corruption. The weakness is classified as CWE‑121: Stack‑Based Buffer Overflow.

The affected product is PX4 Autopilot (PX4:PX4‑Autopilot). All releases prior to 1.17.0‑rc2 are vulnerable, including the alpha1, beta1, and rc1 milestones listed in the CPE data. Devices that have tattu_can compiled and enabled are impacted; if the driver is disabled or not used, the vulnerability is not present.

The CVSS score is 5.2, indicating moderate severity. The EPSS score is less than 1 %, suggesting a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is injection of crafted CAN frames over the vehicle’s CAN bus; this inference is based on the description, which states that the overflow is triggered when tattu_can processes incoming CAN traffic. In deployments where the CAN bus is isolated from untrusted networks, the practical risk is reduced, but any exposed bus provides a feasible exploitation path.