PX4-Autopilot v1.17.0-rc2

Security Fixes

• CVE-2026-32705 - BST device name buffer overflow (GHSA-79mp)
• CVE-2026-32706 - CRSF variable-length packet buffer overflow (GHSA-mqgj)
• CVE-2026-32707 - TattuCan CAN frame buffer overflow (GHSA-wxwm)
• CVE-2026-32708 - Zenoh uORB subscriber stack overflow (GHSA-69g4)
• CVE-2026-32709 - MAVLink FTP path traversal (GHSA-fh32)
• CVE-2026-32713 - MAVLink FTP session validation bypass (GHSA-pp2c)

What’s Changed

• fix(security): backport security fixes to release/1.17 by @mrpollo in https://github.com/PX4/PX4-Autopilot/pull/26741

Full Changelog: https://github.com/PX4/PX4-Autopilot/compare/v1.17.0-rc1…v1.17.0-rc2

---

Source PX4/PX4-Autopilot · v1.17.0-rc2 · 2026-03-13 · upstream release

Mirrored verbatim for indexing. All rights belong to the upstream project.