Description

PX4 Autopilot contains a heap buffer overflow vulnerability in the sd_bench command that writes a four-byte block number into a user-supplied sized allocation. Attackers can invoke sd_bench with a block size below four bytes to overflow the heap buffer and potentially execute code or crash the system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-02T01:17:24.850Z",
  "pubdate": "2026-09-02T01:17:24.850Z",
  "executiveSummary": "The PX4 Autopilot software contains a critical heap buffer overflow vulnerability within the 'sd_bench' command.\nThis vulnerability stems from improper bounds checking during the allocation and write operations of block data.\nAn attacker capable of invoking the 'sd_bench' command can provide a user-supplied block size smaller than the required four bytes, triggering an out-of-bounds heap write.\nThe flaw allows for memory corruption, which may lead to arbitrary code execution or a denial-of-service condition via system crash.\nThe risk is significant for unmanned aerial vehicles (UAVs) and robotic systems utilizing PX4, as the integrity of the autopilot process is compromised upon successful exploitation.\nExploitation requires an attacker to have access to the system console or interface where the 'sd_bench' command is exposed, allowing the injection of malicious block sizes.\nThere are no specific authentication requirements mentioned for the command, implying potential exposure to local or privileged users depending on the deployment environment.",
  "technicalDetails": "The vulnerability resides within the 'sd_bench' utility in the PX4 Autopilot firmware, which is designed to benchmark SD card performance.\nThe root cause is an insufficient validation of user-provided input regarding the size of the block allocation. Specifically, the function allocates heap memory based on a user-defined size parameter without ensuring that this parameter meets the minimum requirements for the subsequent write operations.\nThe 'sd_bench' command expects to write a four-byte block number into the allocated buffer. When a user provides a block size smaller than four bytes, the application allocates an insufficient number of bytes on the heap. During the subsequent write operation, the function proceeds to write the full four-byte block number, disregarding the previously allocated buffer size limits.\nThe exploitation flow follows these steps: first, the attacker triggers the 'sd_bench' command with a size argument less than four; second, the heap allocator allocates the undersized buffer; third, the routine executes a write operation that overflows the allocated heap chunk by overwriting adjacent memory addresses.\nThis overflow allows the attacker to corrupt heap metadata or manipulate adjacent heap objects. If the attacker can influence the heap layout—such as through heap grooming techniques—they may be able to overwrite function pointers or control structures, ultimately hijacking the execution flow of the autopilot firmware.\nThe impact of this corruption is severe, potentially resulting in remote or local code execution, which grants the attacker full control over the flight controller. Alternatively, if the memory corruption triggers an unhandled memory fault, the system will experience a crash, causing a complete denial of service of the navigation and control systems.\nThe vulnerability is restricted to the context where 'sd_bench' is operational, and the ability to execute it depends on the existing interface permissions of the PX4 deployment. Given the nature of embedded systems, this often implies access to the MAVLink shell or a physical debug port."
}