CVE-2026-32706 describes a memory-corruption condition in the PX4 CRSF RC parser before 1.17.0-rc2. An oversized packet on an enabled CRSF serial port could crash the flight controller; the issue is fixed in 1.17.0-rc2 and later.
Sun, 20 Sep 2026
RC links and serial peripherals are part of the attack and reliability surface on increasingly connected aircraft.
Builders using CRSF with older PX4 builds should verify their exact firmware version rather than assuming a physically local serial interface is harmless.