CVE-2023-47625

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-47625

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-47625.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-47625

Aliases

GHSA-qpw7-65ww-wj82

Published

2023-11-13T20:40:56.752Z

Modified

2026-07-15T01:49:17.862087834Z

Severity

2.9 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

Global Buffer Overflow leading to denial of service in PX4-Autopilot

Details

PX4 autopilot is a flight control solution for drones. In affected versions a global buffer overflow vulnerability exists in the CrsfParserTryParseCrsfPacket function in /src/drivers/rc/crsfrc/CrsfParser.cpp:298 due to the invalid size check. A malicious user may create an RC packet remotely and that packet goes into the device where the rcsbuf reads. The global buffer overflow vulnerability will be triggered and the drone can behave unexpectedly. This issue has been addressed in version 1.14.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Database specific

{
    "cwe_ids": [
        "CWE-120"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47625.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/px4/px4-autopilot

Affected ranges

Type

GIT

Repo

https://github.com/px4/px4-autopilot

Events

Introduced

2f5aa925966d43db2cc78073bd8efab9886212a8

Fixed

d1fcd39a44e6312582c6ab02b0d5ee2599fb55aa

Database specific

{
    "cpe": "cpe:2.3:a:dronecode:px4_drone_autopilot:1.14.0:rc2:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.14.0-rc2"
        },
        {
            "last_affected": "1.14.0-rc2"
        }
    ],
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.14.0-rc2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-47625.json"