Description

PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in param_set_default_file() and param_set_backup_file() functions that allows attackers to crash the autopilot process. Attackers can invoke 'param select' or 'param select-backup' commands with no path argument from any PX4 shell to trigger the crash.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-04T23:18:03.547Z",
  "pubdate": "2026-09-04T23:18:03.547Z",
  "executiveSummary": "PX4 Autopilot versions up to 1.17.0 are susceptible to a null pointer dereference vulnerability residing within the parameter management subsystem. This flaw is triggered during the execution of file-related parameter commands, specifically when the input path argument is omitted.\nThe vulnerability is categorized as a denial-of-service (DoS) condition, where the autopilot process terminates abruptly upon processing an invalid command. The flaw affects the param_set_default_file() and param_set_backup_file() functions, which fail to perform adequate input validation on provided file paths.\nSuccessful exploitation allows any entity with access to the PX4 shell—such as a local attacker or an actor capable of command injection—to crash the flight control software. In an autonomous system context, such a crash can result in a loss of flight control, potentially leading to vehicle instability or catastrophic mission failure.\nThe vulnerability does not require complex exploit primitives, as it is triggered through standard shell interface commands. Remediation requires implementing robust argument validation to ensure that null pointer references are handled safely before they reach sensitive memory operations within the parameter management logic.",
  "technicalDetails": "The vulnerability exists within the parameter management framework of PX4 Autopilot, specifically affecting the param_set_default_file() and param_set_backup_file() functions. The root cause is an insecure handling of input parameters, where the functions process command-line arguments without verifying the existence or validity of the provided file path pointer.\nWhen a user interacts with the PX4 shell, the 'param select' or 'param select-backup' commands are designed to set the file path for parameter storage or backup operations. Under normal operating conditions, these functions expect a valid pointer to a string representing the file system path. However, if the command is invoked without a path argument, the underlying logic passes a null pointer to the string processing or file handle initialization routines.\nBecause these functions do not check if the pointer is null before attempting to dereference it or pass it to standard library string handling functions, the autopilot process triggers a memory access violation. In the embedded environment of PX4, this dereference event results in an immediate exception, forcing the process to terminate. This effectively crashes the flight control loop, which is critical for maintaining vehicle stability.\nThe attack flow is straightforward: an actor with shell access issues the command 'param select' or 'param select-backup' without the required argument. The command processor parses this input and passes the resulting empty (null) reference to the vulnerable functions. As the process attempts to perform operations like 'strlen' or memory copy on the null address, the CPU faults due to the invalid memory access. This behavior is deterministic and does not require complex heap grooming or bypasses of modern security mitigations, as the crash occurs at the application layer within the firmware's execution context.\nThe vulnerability is persistent across all versions up to 1.17.0 and is accessible to any entity capable of interacting with the system shell. Because the shell is often exposed via telemetry links or physical debug ports, the threat surface includes both remote entities (if the MAVLink shell is exposed) and local physical attackers. The impact is significant because the autopilot process is the primary control loop; its forced termination results in an immediate loss of system functionality, presenting an unrecoverable state for a flying vehicle."
}