CVE-2026-86714 PX4 Autopilot through 1.17.0 Stack Buffer Over-read via netman
Attackers can leak stack memory via a stack buffer over-read in the netman system command by supplying long interface names.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-86714?
CVE-2026-86714 is a medium-severity vulnerability in PX4-Autopilot, published on 8 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
PX4 Autopilot through 1.17.0 contains a stack buffer over-read vulnerability in the netman system command that fails to validate interface name length. Attackers can supply interface names of 74 bytes or more via the -i option to read beyond buffer boundaries, leaking stack memory to console output or writing it into persistent network configuration files.
Weakness: CWE-125
Which versions are affected by CVE-2026-86714?
How do I fix CVE-2026-86714?
No fix has been published for CVE-2026-86714 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-86714 being exploited?
There is no known exploitation of CVE-2026-86714 in the wild and no public exploit code.
Sources
Also known as GHSA-6x78-rh4h-q7jx.