Px4 Drone Autopilot
Vendor:
First CVE: Mar 9, 2023 · Active for 3 years
23
Total CVEs
More Total CVEs than 95% of tracked products
5.8
Avg CVEs / Year
Higher CVE frequency than 90% of tracked products
6.7
Avg CVSS
Higher Avg CVSS than 34% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Px4 Drone Autopilot over time
Volume of CVEsAvg CVSS Base Score
First CVE
Mar 9, 2023
3 years ago
Most Recent CVE
Mar 19, 2026
126 days ago
CVE Severity & Scoring
Px4 Drone Autopilot23 CVEs
57%
39%
All CVEs352,101 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local5 (21.7%)
Network7 (30.4%)
Unknown0 (0.0%)
Physical2 (8.7%)
Adjacent Network9 (39.1%)
Attack Complexity
Low17 (73.9%)
High6 (26.1%)
Unknown0 (0.0%)
User Interaction
None19 (82.6%)
Unknown0 (0.0%)
Required4 (17.4%)
Privileges Required
Low8 (34.8%)
High1 (4.3%)
None14 (60.9%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (23 CVEs).
23 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-32708HIGH PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, the Zenoh uORB subscriber allocates a stack VLA directly from the incoming payload length without bounds | Mar 13, 2026 | 8.0 | 28 | NO | NO |
CVE-2023-46256CRITICAL PX4-Autopilot provides PX4 flight control solution for drones. In versions 1.14.0-rc1 and prior, PX4-Autopilot has a heap buffer overflow vulnerability in the parser function due t | Oct 31, 2023 | 9.8 | 27 | NO | NO |
CVE-2026-26742HIGH PX4 Autopilot versions 1.12.x through 1.15.x contain a protection mechanism failure in the "Re-arm Grace Period" logic. The system incorrectly applies the in-air emergency re-arm l | Mar 10, 2026 | 8.1 | 26 | NO | NO |
CVE-2026-26741HIGH PX4 Autopilot versions 1.12.x through 1.15.x contain a logic flaw in the mode switching mechanism. When switching from Auto mode to Manual mode while the drone is in the "ARMED" st | Mar 10, 2026 | 8.1 | 26 | NO | NO |
CVE-2026-32743MEDIUM PX4 is an open-source autopilot stack for drones and unmanned vehicles. Versions 1.17.0-rc2 and below are vulnerable to Stack-based Buffer Overflow through the MavlinkLogHandler, a | Mar 19, 2026 | 6.5 | 25 | NO | NO |
CVE-2025-15150HIGH A vulnerability was found in PX4 PX4-Autopilot up to 1.16.0. Affected by this issue is the function MavlinkLogHandler::state_listing/MavlinkLogHandler::log_entry_from_id of the fil | Dec 28, 2025 | 7.8 | 25 | NO | NO |
CVE-2021-34125HIGH An issue discovered in Yuneec Mantis Q and PX4-Autopilot v 1.11.3 and below allow attacker to gain access to sensitive information via various nuttx commands. | Mar 9, 2023 | 7.5 | 24 | NO | NO |
CVE-2026-32706HIGH PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, The crsf_rc parser accepts an oversized variable-length known packet and copies it into a fixed 64-byte | Mar 16, 2026 | 8.1 | 23 | NO | NO |
CVE-2024-40427HIGH Stack Buffer Overflow in PX4-Autopilot v1.14.3, which allows attackers to execute commands to exploit this vulnerability and cause the program to refuse to execute | Jan 7, 2025 | 7.9 | 22 | NO | NO |
CVE-2021-46896HIGH Buffer Overflow vulnerability in PX4-Autopilot allows attackers to cause a denial of service via handler function handling msgid 332. | Jul 6, 2023 | 7.5 | 22 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (23 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (23 CVEs).
Media Mentions
Signals from CVEs in this product scope (23 CVEs).
Top CNAs Publishing CVEs For Px4 Drone Autopilot
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 1.17.0 | 8 | 6.8 | 0.3% | 0 | 0 |
| 1.14.3 | 1 | 7.5 | 0.7% | 0 | 0 |
| 1.14.0 | 4 | 7.7 | 0.5% | 0 | 0 |
| 1.12.3 | 1 | 6.5 | 0.5% | 0 | 0 |