ASEC Discloses Flight Stack CVEs in PX4 and MAVLink

Sample post, placeholder content for layout.

ASEC just closed responsible disclosure on a set of vulnerabilities in the PX4 flight stack and the MAVLink protocol that carries its commands. The reserved identifiers are CVE-2026-XXXXX and CVE-2026-XXXXX, with a third still pending assignment.

The bug class is the one that keeps showing up in autonomous systems: trusted-by-default message handling. When a flight controller assumes anything speaking MAVLink is friendly, an attacker on the link can inject commands, corrupt navigation state, or push a vehicle into a mode it should never enter mid-flight. On a platform that makes its own decisions at altitude, a memory-safety slip in the parser is not a crash, it is a falling object.

We reported both issues through coordinated disclosure and gave the maintainers room to ship fixes before publishing. Patches are landing now.

This is the exact failure pattern we built Damn Vulnerable Drone to teach. The lab was the training ground; these findings are what the training is for. If you run PX4 anywhere in production, update, and treat your command link as hostile by default.