PX4 Autopilot is vulnerable to a stack‑based buffer overflow in the MavlinkLogHandler. When a MAVLink log request is processed, the LogEntry.filepath buffer (60 bytes) is filled via sscanf without a width specifier, allowing an attacker to submit a path longer than 60 characters. The overflow crashes the flight controller’s MAVLink task, causing loss of telemetry and command capability and effectively denying service to the vehicle.

The affected vendor is PX4 (PX4‑Autopilot). Versions 1.17.0‑rc2 and all earlier releases are vulnerable. The issue was fixed in commit 616b25a280e229c24d5cf12a03dbf248df89c474, which can be applied by upgrading to a newer PX4 release.

The CVSS Score of 6.5 indicates moderate severity. EPSS scoring shows exploitation probability of less than 1%, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector requires the attacker to have MAVLink link access—typically on the same network or via direct connection to the drone. Exploitation involves creating deeply nested directories over MAVLink FTP and then sending a log list request, after which the drone will crash and enter a DoS state.