PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, the Zenoh uORB subscriber allocates a stack VLA directly from the incoming payload l…

CVE-2026-32708 affects PX4 autopilot flight control solution for drones. The vulnerability exists in versions prior to 1.17.0-rc2 where the Zenoh uORB subscriber allocates a stack VLA directly from incoming payload length without bounds checking. A remote Zenoh publisher can exploit this by sending oversized fragmented messages to force unbounded stack allocation and copy operations. This results in stack overflow and crash of the Zenoh bridge task. The vulnerability has been fixed in version 1.17.0-rc2.