CVE-2026-86096 | BDVDB-2026-368445 Detail
PX4PX4-Autopilot
Description#
PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start() due to a race condition between task spawning and object deletion. Attackers can trigger the calibration process via shell commands to write to freed heap memory, corrupting unrelated objects or allocator metadata and destabilizing heap operations.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact low, availability impact high. Attack vector: adjacent.
Weaknesses#
- CWE-416 Use After Free
References#
- https://github.com/PX4/PX4-Autopilot/pull/28487
- https://github.com/PX4/PX4-Autopilot/commit/b182e523d154fe029a49b48bb5f9d3d6693bc6bb
- https://github.com/PX4/PX4-Autopilot
- https://github.com/PX4/PX4-Autopilot/blob/v1.17.0/src/modules/temperature_compensation/temperature_calibration/task.cpp
- https://www.vulncheck.com/advisories/px4-autopilot-through-1.17.0-use-after-free-via-temperature-calibration-task-startup
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.