CVE-2023-47625

    Dashboard / Vulnerabilities / CVE-2023-47625

    CVE-2023-47625

    Published: 13 Nov 2023Last Modified: 12 Aug 2026

    Summary: Global Buffer Overflow leading to denial of service in PX4-Autopilot

    Details: PX4 autopilot is a flight control solution for drones. In affected versions a global buffer overflow vulnerability exists in the CrsfParser_TryParseCrsfPacket function in /src/drivers/rc/crsf_rc/CrsfParser.cpp:298 due to the invalid size check. A malicious user may create an RC packet remotely and that packet goes into the device where the _rcs_buf reads. The global buffer overflow vulnerability will be triggered and the drone can behave unexpectedly. This issue has been addressed in version 1.14.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47625.json, https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-qpw7-65ww-wj82, https://nvd.nist.gov/vuln/detail/CVE-2023-47625, https://github.com/PX4/PX4-Autopilot/commit/d1fcd39a44e6312582c6ab02b0d5ee2599fb55aa

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 2f5aa925966d43db2cc78073bd8efab9886212a8
    Fixed -d1fcd39a44e6312582c6ab02b0d5ee2599fb55aa

    Affected versions

    1.14.0-rc2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-47625 | CVE-DB