CVE-2026-86714

Name of the Vulnerable Software and Affected Versions PX4 Autopilot versions prior to 1.17.1

Description The netman system command fails to validate the length of the interface name. An attacker can provide an interface name of 74 bytes or more using the -i option to trigger a stack buffer over-read, which occurs when a program reads more data from a buffer than it actually contains. This can result in stack memory being leaked to the console output or written into persistent network configuration files.

Recommendations Update PX4 Autopilot to a version newer than 1.17.0.