CVE-2026-84698: PX4 PX4-Autopilot

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

PX4 Autopilot contains a heap buffer overflow vulnerability in the sd_bench command that writes a four-byte block number into a user-supplied sized allocation. Attackers can invoke sd_bench with a block size below four bytes to overflow the heap buffer and potentially execute code or crash the system.

Affected products

• PX4 PX4-Autopilot: up to and including 1.17.0

Published 2026-09-02. Last modified 2026-09-10.