CVE-2026-86096
PX4 Autopilot through 1.17.0 Use-After-Free via Temperature Calibration Task Startup
- State
- Published
- Severity
- 6.0 Medium
- Published
- Sep 4, 2026
- Updated
- Sep 10, 2026
- Reserved
- Sep 4, 2026
Description
PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start() due to a race condition between task spawning and object deletion. Attackers can trigger the calibration process via shell commands to write to freed heap memory, corrupting unrelated objects or allocator metadata and destabilizing heap operations.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.0 Medium | CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.9 Medium | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H | VulnCheck |
Weaknesses
- CWE-416 Use After Free
Affected Products
| Product | Versions |
|---|---|
PX4-AutopilotPX4 |
|
References
- Fix Pull Requestpatchissue-tracking
- Patch Commitpatch
- https://github.com/PX4/PX4-Autopilotproduct
- TemperatureCalibration::start() writes _control_task after spawn, v1.17.0technical-description
- VulnCheck Advisory: PX4 Autopilot through 1.17.0 Use-After-Free via Temperature Calibration Task Startupthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.