An unauthenticated adjacent attacker can exploit a buffer overflow in PX4-Autopilot to induce memory corruption and cause a system crash, posing a significant risk to flight stability.

The vulnerability is a buffer copy without checking size (CWE-120) occurring in the crsf_rc parser. An unauthenticated attacker with access to a CRSF serial port can send an oversized packet, resulting in an out-of-bounds write to a fixed 64-byte global buffer.

The exploitation of this flaw can lead to a complete loss of flight control by crashing the autopilot system. Given the 7.1 CVSS score, this represents a high-severity operational risk for drone operators, as it could result in the total loss of hardware and potential safety hazards during flight operations.

Immediate Action: Update the PX4-Autopilot firmware to version 1.17.0-rc2 or later immediately to incorporate the necessary bounds checks.

Proactive Monitoring: Monitor serial port traffic for malformed or oversized packet structures that deviate from the expected CRSF protocol specifications.

Compensating Controls: Restrict physical or signal access to the serial ports utilized for CRSF communications to prevent unauthorized adjacent attackers from interacting with the vulnerable parser.

Public Exploit Available: No — there is no confirmed public exploit available in the provided data.

Due to the critical nature of flight control systems, this vulnerability must be addressed with high priority. Organizations operating drones equipped with affected versions of PX4-Autopilot should verify their firmware versions and apply the update to 1.17.0-rc2 to eliminate the risk of memory corruption and unexpected system failure.