The vulnerability is a heap buffer overflow in the sd_bench command of PX4 Autopilot. The program writes a four‑byte block number into an allocation whose size is supplied by the user. When the supplied block size is less than four bytes, the write overruns the heap buffer, which may lead to arbitrary code execution or a crash. The weakness is identified as CWE‑787, a classic buffer overflow scenario.

The affected product is PX4 Autopilot. No specific version information is supplied, so any deployment of PX4 that includes the sd_bench command without a patched implementation is potentially vulnerable.

The CVSS score of 7.1 indicates a moderate to high impact. With no EPSS data available and the vulnerability not listed in CISA KEV, the exploitation probability is uncertain but non‑negligible. The attack vector is inferred to be local or remote command execution of sd_bench with a malicious block size parameter, which could enable code execution or denial of service on the target system.