Zenoh uORB subscriber in PX4 autoinit autopilot fails to bound the length of a variable-length array allocated on the stack from the payload length reported by a remote Zenoh publisher. An attacker can send a fragmented message with an oversized length to force an unbounded stack allocation and subsequent write beyond the bounds, overflowing the call stack and crashing the Zenoh bridge task. The crash prevents further function of the bridge, effectively denying service for any flight control operations dependent on that task. The weakness responsible is a classic stack buffer overflow, corresponding to CWE‑121.

The flaw applies to PX4 Autopilot builds prior to version 1.17.0‑rc2, including the 1.17.0‑alpha1, 1.17.0‑beta1, 1.17.0‑rc1 releases and any earlier returns. The advisory states the issue is fixed in 1.17.0‑rc2 and later updates of PX4 Autopilot.

The CVSS score of 7.8 indicates a high severity. EPSS is below 1 %, suggesting a low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. The vulnerability can be exploited remotely by acting as a Zenoh publisher, sending an oversized fragmented message that forces a stack overflow and causes a crash of the bridge task. The impact is limited to denial of service and does not directly compromise confidentiality or integrity.