CVE-2026-26011
Published: 12 February 2026
Description
navigation2 is a ROS 2 Navigation Framework and System. In 1.3.11 and earlier, a critical heap out-of-bounds write vulnerability exists in Nav2 AMCL's particle filter clustering logic. By publishing a single crafted geometry_msgs/PoseWithCovarianceStamped message with extreme covariance values to the…
more
/initialpose topic, an unauthenticated attacker on the same ROS 2 DDS domain can trigger a negative index write (set->clusters[-1]) into heap memory preceding the allocated buffer. In Release builds, the sole boundary check (assert) is compiled out, leaving zero runtime protection. This primitive allows controlled corruption of the heap chunk metadata(at least the size of the heap chunk where the set->clusters is in is controllable by the attacker), potentially leading to further exploitation. At minimum, it provides a reliable single-packet denial of service that kills localization and halts all navigation.
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the heap out-of-bounds write vulnerability by applying patches such as commit d09ea82477ce9234678a6febf6890235e0a7ce12 to versions beyond 1.3.11.
Validates geometry_msgs/PoseWithCovarianceStamped messages on the /initialpose topic to reject extreme covariance values that trigger the negative index write into heap memory.
Deploys memory protection mechanisms to prevent unauthorized code execution and exploitation from the controlled heap chunk metadata corruption caused by the out-of-bounds write.
Security SummaryAI
CVE-2026-26011 is a critical heap out-of-bounds write vulnerability (CWE-122, CWE-787) in the particle filter clustering logic of Nav2 AMCL within navigation2, a ROS 2 Navigation Framework and System. It affects versions 1.3.11 and earlier. The issue arises from a negative index write (set->clusters[-1]) into heap memory preceding the allocated buffer when processing extreme covariance values.
An unauthenticated attacker on the same ROS 2 DDS domain can exploit this vulnerability by publishing a single crafted geometry_msgs/PoseWithCovarianceStamped message to the /initialpose topic. In Release builds, the sole boundary check (an assert) is compiled out, providing no runtime protection and allowing controlled corruption of heap chunk metadata, including the size of the chunk containing set->clusters. This primitive enables potential further exploitation, with a minimum impact of reliable single-packet denial of service that kills localization and halts all navigation. The vulnerability scores 9.8 on CVSS v3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
The GitHub security advisory GHSA-mgj5-g2p6-gc5x and commit d09ea82477ce9234678a6febf6890235e0a7ce12 in the ros-navigation/navigation2 repository detail the patch, which addresses the vulnerability in versions beyond 1.3.11.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote exploitation of a network-accessible ROS 2 service (DDS topic) enables initial access (T1190) and reliable single-packet application crash for denial of service via heap corruption (T1499.004), with potential for further RCE.