PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, The crsf_rc parser accepts an oversized variable-length known packet and copies it i…

CVE-2026-32706 is a buffer overflow vulnerability in PX4 autopilot flight control solution for drones. The crsf_rc parser accepts oversized variable-length packets and copies them into a fixed 64-byte global buffer without bounds checking. This allows adjacent/raw-serial attackers to trigger memory corruption and crash PX4 systems when crsf_rc is enabled on CRSF serial ports. The vulnerability affects versions prior to 1.17.0-rc2 and has been fixed in version 1.17.0-rc2.