CVE-2026-86096

Received Received - Intake

PX4 Autopilot Use-After-Free via Race Condition in Temperature Calibration

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description

PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start() due to a race condition between task spawning and object deletion. Attackers can trigger the calibration process via shell commands to write to freed heap memory, corrupting unrelated objects or allocator metadata and destabilizing heap operations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-04

Last Modified

2026-09-04

Generated

2026-09-05

AI Q&A

2026-09-05

EPSS Evaluated

N/A

NVD

CVE-2026-86096

Affected Vendors & Products

Vendor	Product	Version / Range
px4	autopilot	to 1.17.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability is a use-after-free issue in PX4 Autopilot versions up to 1.17.0. It occurs due to a race condition between task spawning and object deletion in the TemperatureCalibration::start() function. Attackers can exploit this by triggering calibration via shell commands, leading to writes in freed heap memory. This corrupts unrelated objects or allocator metadata, destabilizing heap operations.

Detection Guidance

This vulnerability involves a use-after-free in PX4 Autopilot due to a race condition in TemperatureCalibration::start(). Detection requires checking for signs of heap corruption or crashes during calibration processes. Monitor system logs for crashes or memory errors during calibration tasks. Check for unexpected writes to freed memory regions by analyzing heap allocator logs or using tools like AddressSanitizer.

Impact Analysis

This vulnerability can allow attackers to corrupt heap memory, potentially causing crashes, data corruption, or arbitrary code execution. If exploited, it may lead to system instability, unauthorized access, or denial-of-service conditions in systems running affected PX4 Autopilot versions.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it is a use-after-free issue in PX4 Autopilot affecting system stability rather than data privacy or security controls. However, if exploited, it could lead to system instability or crashes, potentially disrupting operations that handle sensitive data under these regulations.

Mitigation Strategies

Upgrade PX4 Autopilot to version 1.17.1 or later to address the use-after-free issue. Avoid triggering calibration processes unnecessarily. Implement strict input validation for shell commands that initiate calibration. Monitor system stability and memory usage for signs of corruption after calibration tasks.

Hi! I’m here to help you understand CVE-2026-86096. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70