CVE-2026-32708 Zenoh uORB Subscriber Allows Arbitrary Stack Allocation (PX4/PX4-Autopilot)

High 7.8 Published 13 Mar 2026 Updated 17 Mar 2026

Remote attackers can crash the Zenoh bridge task by sending oversized messages, causing a stack overflow in PX4 autopilot systems.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-32708?

CVE-2026-32708 is a high-severity denial of service vulnerability in PX4-Autopilot, published on 13 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, the Zenoh uORB subscriber allocates a stack VLA directly from the incoming payload length without bounds. A remote Zenoh publisher can send an oversized fragmented message to force an unbounded stack allocation and copy, causing a stack overflow and crash of the Zenoh bridge task. This vulnerability is fixed in 1.17.0-rc2.

Weakness: CWE-121

Which versions are affected by CVE-2026-32708?

It affects 1 product.

Products include Dronecode Px4 Drone Autopilot.

How do I fix CVE-2026-32708?

No fix has been published for CVE-2026-32708 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-32708 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32708 exists.

Sources

Also known as GHSA-69g4-hcqf-j45p.