CVE-2026-86096
PX4 Autopilot through 1.17.0 Use-After-Free via Temperature Calibration Task Startup
CVSS Score
5.9
EPSS Score
0.0%
EPSS Percentile
0th
PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start() due to a race condition between task spawning and object deletion. Attackers can trigger the calibration process via shell commands to write to freed heap memory, corrupting unrelated objects or allocator metadata and destabilizing heap operations.
| CWE | CWE-416 |
| Vendor | px4 |
| Product | px4-autopilot |
| Published | Sep 4, 2026 |
| Last Updated | Sep 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for px4 px4-autopilot
Be the first to know when new medium vulnerabilities affecting px4 px4-autopilot are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
High
Affected Versions
PX4 / PX4-Autopilot
0 ≤ 1.17.0
References
github.com: https://github.com/PX4/PX4-Autopilot/pull/28487 github.com: https://github.com/PX4/PX4-Autopilot/commit/b182e523d154fe029a49b48bb5f9d3d6693bc6bb github.com: https://github.com/PX4/PX4-Autopilot github.com: https://github.com/PX4/PX4-Autopilot/blob/v1.17.0/src/modules/temperature_compensation/temperature_calibration/task.cpp vulncheck.com: https://www.vulncheck.com/advisories/px4-autopilot-through-1.17.0-use-after-free-via-temperature-calibration-task-startup
Credits
Xiaoyang Chen