CVE-2026-86713
PX4 Autopilot through 1.17.0 Use-After-Free in load_mon
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th
PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the load_mon module's stop path where exit_and_cleanup() deletes the LoadMon object and frees the performance counter before perf_end() attempts to access it. Attackers can trigger this vulnerability by issuing the load_mon stop command from any PXH or MAVLink shell, causing reads and writes through freed memory that corrupt heap objects and destabilize the flight stack.
| CWE | CWE-416 |
| Vendor | px4 |
| Product | px4-autopilot |
| Published | Sep 8, 2026 |
| Last Updated | Sep 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for px4 px4-autopilot
Be the first to know when new high vulnerabilities affecting px4 px4-autopilot are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
High
Affected Versions
PX4 / PX4-Autopilot
0 ≤ 1.17.0
References
github.com: https://github.com/PX4/PX4-Autopilot/pull/28544 github.com: https://github.com/PX4/PX4-Autopilot/commit/354823e2efd8dd7ac47f4b8984b8e0fb06dc3b79 github.com: https://github.com/PX4/PX4-Autopilot github.com: https://github.com/PX4/PX4-Autopilot/blob/v1.17.0/src/modules/load_mon/LoadMon.cpp vulncheck.com: https://www.vulncheck.com/advisories/px4-autopilot-through-1.17.0-use-after-free-in-load-mon
Credits
Tianbo Wang Xiaoyang Chen