Vulnerability · Published Sep 8, 2026 · Assigned by VulnCheck

CVE-2026-86713PX4 Autopilot through 1.17.0 Use-After-Free in load_mon

High 7.1

In plain English

A high-severity use-after-free in PX4-Autopilot from PX4. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.4%top 67.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the load_mon module's stop path where exit_and_cleanup() deletes the LoadMon object and frees the performance counter before perf_end() attempts to access it. Attackers can trigger this vulnerability by issuing the load_mon stop command from any PXH or MAVLink shell, causing reads and writes through freed memory that corrupt heap objects and destabilize the flight stack.

Affected products (as reported)

Vendor	Product	Versions
PX4	PX4-Autopilot	0 – through 1.17.0

Weakness: CWE-416 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

References

Fix Pull Request patch, issue-tracking
Patch Commit patch
https://github.com/PX4/PX4-Autopilot product
LoadMon::Run() calls perf_end(_cycle_perf) after exit_and_cleanup(), v1.17.0 technical-description
VulnCheck Advisory: PX4 Autopilot through 1.17.0 Use-After-Free in load_mon third-party-advisory