CVE-2026-86097

Received Received - Intake

Null Pointer Dereference in PX4 Autopilot

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description

PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in param_set_default_file() and param_set_backup_file() functions that allows attackers to crash the autopilot process. Attackers can invoke 'param select' or 'param select-backup' commands with no path argument from any PX4 shell to trigger the crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-04

Last Modified

2026-09-04

Generated

2026-09-05

AI Q&A

2026-09-05

EPSS Evaluated

N/A

NVD

CVE-2026-86097

Affected Vendors & Products

Vendor	Product	Version / Range
px4	autopilot	to 1.17.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

PX4 Autopilot through version 1.17.0 has a null pointer dereference flaw in the param_set_default_file() and param_set_backup_file() functions. Attackers can exploit this by running 'param select' or 'param select-backup' commands without a path argument from any PX4 shell, causing the autopilot process to crash.

Detection Guidance

Check for PX4 Autopilot versions through 1.17.0. Look for crashes in the autopilot process when 'param select' or 'param select-backup' commands are executed without a path argument from any PX4 shell.

Impact Analysis

This vulnerability allows attackers to crash the PX4 Autopilot process, potentially disrupting drone or autonomous vehicle operations. The impact is denial of service as the system becomes unresponsive.

Compliance Impact

This vulnerability causes a denial-of-service (DoS) condition by crashing the PX4 autopilot process, which could disrupt critical operations in systems handling sensitive data. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could affect the integrity and availability of protected health information systems.

Mitigation Strategies

Upgrade PX4 Autopilot to a version beyond 1.17.0. Restrict access to PX4 shell commands to prevent unauthorized execution of 'param select' or 'param select-backup' without path arguments.

Hi! I’m here to help you understand CVE-2026-86097. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70