CVE-2026-102808
PX4 Autopilot through 1.17.0 contains a NULL pointer dereference vulnerability in the sd_stress command where the -b byte count parameter is
CVSS
6.5
Medium
EPSS
0.2%
p15
KEV
—
Exploit Today
4
0-100
Published: Sep 29, 2026 · Last modified: Oct 2, 2026 · CWE-476
0.2%EPSS · 30 days0.2%
2026-09-302026-10-19
PX4 Autopilot through 1.17.0 contains a NULL pointer dereference vulnerability in the sd_stress command where the -b byte count parameter is parsed without validation before being passed to malloc() and memset(). Attackers with shell access, including through MAVLink, can supply invalid byte count values to crash the flight controller.
- github.comhttps://github.com/PX4/PX4-Autopilot
- github.comhttps://github.com/PX4/PX4-Autopilot/blob/d6f12ad1c4f70ad3230afd7d86e971421e02fef4/src/systemcmds/sd_stress/sd_stress.cpp#L186-L204
- github.comhttps://github.com/PX4/PX4-Autopilot/commit/c865dc9fde14d1391916775153aa271603c3c592
- github.comhttps://github.com/PX4/PX4-Autopilot/pull/28795
- www.vulncheck.comhttps://www.vulncheck.com/advisories/px4-autopilot-through-1.17.0-null-pointer-dereference-via-sd-stress
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1140466.5 MED—
———FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or _wcscmp to crash the client process.6hCVE-2026-1136805.5 MED—
———HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffer_set_contents, face_create, and font_set_coords. Attackers can supply a crafted font whose embedded wasm module passes out-of-range addresses with non-zero lengths, crashing any application that shapes text with the font.11hCVE-2026-43842——
——0A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function when msglen is set to 0.12hCVE-2026-43841——
——0A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function.12hCVE-2026-43839——
——0A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service.12hCVE-2026-112405——
——0Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge() can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bit integer or floating-point image backed by image32 storage to be merged as a narrower multiband image. A crafted IPTC file can reach this path when an application opens and loads it, or a caller can invoke Image.merge() directly with such a first band. This causes a native process crash. This issue is fixed in version 13.0.0.11h