Medium 5.3Published Dec 28, 2025

CVE-2025-15150PX4 PX4-Autopilot mavlink_log_handler.cpp log_entry_from_id stack-based overflow

Updated under an hour ago (Oct 27, 2026, 8:40 AM ET)

Does this affect you?

It affects PX4-Autopilot and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for PX4-Autopilot

Exploited in the last 30 days

A vulnerability was found in PX4 PX4-Autopilot up to 1.16.0. Affected by this issue is the function MavlinkLogHandler::state_listing/MavlinkLogHandler::log_entry_from_id of the file src/modules/mavlink/mavlink_log_handler.cpp. The manipulation results in stack-based buffer overflow. The attack is only possible with local access. The patch is identified as 338595edd1d235efd885fd5e9f45e7f9dcf4013d. It is best practice to apply a patch to resolve this issue.

CVSS: 5.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C
Weakness (CWE): CWE-121, CWE-119
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulDB
NVD analysis: Analyzed
Record last updated: Dec 29, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

PX4 PX4-Autopilot px4:autopilot (from the name)	1.0; 1.1; 1.2; 1.3; 1.4; 1.5; 1.6; 1.7; and 9 more ranges	CNA record
dronecode px4_drone_autopilot dronecode:px4_drone_autopilot	through 1.16.0	NVD

References

References

https://vuldb.com/?id.338527	vdb-entry, technical-description, third-party-advisory
https://vuldb.com/?ctiid.338527	signature, permissions-required, vdb-entry
https://vuldb.com/?submit.717323	third-party-advisory, vdb-entry
https://github.com/PX4/PX4-Autopilot/issues/26118	issue-tracking, exploit
https://github.com/PX4/PX4-Autopilot/pull/26124	issue-tracking, exploit, patch
https://github.com/PX4/PX4-Autopilot/pull/26124/commits/338595edd1d235efd885fd5e9f45e7f9dcf4013d	issue-tracking, patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.