CVE-2026-86096
MediumCVSS 5.9Summary
PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start() due to a race condition between task spawning and object deletion. Attackers can trigger the calibration process via shell commands to write to freed heap memory, corrupting unrelated objects or allocator metadata and destabilizing heap operations.
Risk Assessment
Heap memory corruption could lead to system crashes or unpredictable behavior, potentially compromising the safety of operations using the autopilot.
Recommendation
Upgrade PX4 Autopilot to a version later than 1.17.0 if a fix is available. Restrict access to the shell and calibration commands to trusted users only.
Other vulnerabilities in PX4 Autopilot
See all- CVE-2026-86097Medium
PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in param_set_default_file() and param_set_backup_file() functions that allows attackers to crash the autopilot process. Attackers can invoke 'param select' or 'param select-backup' commands with no path argument from any PX4 shell to trigger the crash.
- CVE-2026-84698Medium
PX4 Autopilot contains a heap buffer overflow vulnerability in the sd_bench command that writes a four-byte block number into a user-supplied sized allocation. Attackers can invoke sd_bench with a block size below four bytes to overflow the heap buffer and potentially execute code or crash the system.
Original NVD description (English source)
PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start() due to a race condition between task spawning and object deletion. Attackers can trigger the calibration process via shell commands to write to freed heap memory, corrupting unrelated objects or allocator metadata and destabilizing heap operations.