CVE-2025-15150 Details
Description
A vulnerability was found in PX4 PX4-Autopilot up to 1.16.0. Affected by this issue is the function MavlinkLogHandler::state_listing/MavlinkLogHandler::log_entry_from_id of the file src/modules/mavlink/mavlink_log_handler.cpp. The manipulation results in stack-based buffer overflow. The attack is only possible with local access. The patch is identified as 338595edd1d235efd885fd5e9f45e7f9dcf4013d. It is best practice to apply a patch to resolve this issue.
A stack-based buffer overflow vulnerability has been identified in PX4 Autopilot versions through 1.16.0. The issue arises in the MavlinkLogHandler functions 'state_listing' and 'log_entry_from_id' within 'src/modules/mavlink/mavlink_log_handler.cpp'. The vulnerability is caused by unbounded input handling: 'LogEntry.filepath' is a fixed-size buffer of approximately 60 bytes, yet the parsing of 'logdata.txt' employs 'sscanf' without a width limit. This flaw allows an excessively long filename or path token to overflow the stack, potentially leading to a crash. The vulnerability can be exploited remotely through the FTP microservice by creating a log file with a long filename, then sending specific MAVLink log requests that trigger the overflow during log data parsing.
Users are advised to update to the latest version of PX4 Autopilot, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 29, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/PX4/PX4-Autopilot/issues/26118 | CISA-ADP | Exploit |
| https://github.com/PX4/PX4-Autopilot/issues/26118 | [email protected] | Exploit |
| https://github.com/PX4/PX4-Autopilot/pull/26124 | [email protected] | ExploitPatch |
| https://github.com/PX4/PX4-Autopilot/pull/26124/commits/338595edd1d235efd885fd5e9f45e7f9dcf4013d | [email protected] | Patch |
| https://vuldb.com/?ctiid.338527 | [email protected] | Permissions RequiredVDB Entry |
| https://vuldb.com/?id.338527 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/?submit.717323 | [email protected] | Third Party AdvisoryVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | [email protected] |
| CWE-121 | Stack-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dronecode px4 drone autopilot | <= 1.16.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 31, 2025 | Initial Analysis | [email protected] |
| Dec 29, 2025 | CVE Modified | CISA-ADP |
| Dec 28, 2025 | New CVE Received | [email protected] |