CVE-2025-15150 - CVE House
Back to Database
Status published Medium CVE-2025-15150

PX4 PX4-Autopilot mavlink_log_handler.cpp log_entry_from_id stack-based overflow

Vulnerability Description

A vulnerability was found in PX4 PX4-Autopilot up to 1.16.0. Affected by this issue is the function MavlinkLogHandler::state_listing/MavlinkLogHandler::log_entry_from_id of the file src/modules/mavlink/mavlink_log_handler.cpp. The manipulation results in stack-based buffer overflow. The attack is only possible with local access. The patch is identified as 338595edd1d235efd885fd5e9f45e7f9dcf4013d. It is best practice to apply a patch to resolve this issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-15150

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Fuzz0X (VulDB User)

References

More from PX4

View All →
CVE-2025-9020
PX4 PX4-Autopilot Mavlink Shell Closing mavlink_receiver.cpp handle_message_serial_control use after free
Low 2
CVE-2023-47625
Global Buffer Overflow leading to denial of service in PX4-Autopilot
Low 2.9
CVE-2023-46256
PX4-Autopilot Heap Buffer Overflow Bug
Medium 4.4
CVE-2020-10283
RVD#3317: MAVLink version handshaking allows for an attacker to bypass authentication
High 8.1

Affected Vendor

Affected Software

PX4-Autopilot
Vulnerable Versions:
1.0, 1.1, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12, 1.13, 1.14, 1.15, 1.16.0

Timeline

Official Publish: December 28th, 2025
Last Modified: December 29th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

Weaknesses (CWE)

CWE-121 CWE-119

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1055 Process Injection
Defense Evasion
T1105 Ingress Tool Transfer
Command and Control
T1485 Data Destruction
Impact
T1203 Exploitation for Client Execution
Execution