Vulnerability · Published Sep 4, 2026 · Assigned by VulnCheck
CVE-2026-86096PX4 Autopilot through 1.17.0 Use-After-Free via Temperature Calibration Task Startup
Medium 5.9
In plain English
A medium-severity use-after-free in PX4-Autopilot from PX4. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).
Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.3%top 73.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start() due to a race condition between task spawning and object deletion. Attackers can trigger the calibration process via shell commands to write to freed heap memory, corrupting unrelated objects or allocator metadata and destabilizing heap operations.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PX4 | PX4-Autopilot | 0 – through 1.17.0 |
Weakness: CWE-416 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
References
- Fix Pull Request patch, issue-tracking
- Patch Commit patch
- https://github.com/PX4/PX4-Autopilot product
- TemperatureCalibration::start() writes _control_task after spawn, v1.17.0 technical-description
- VulnCheck Advisory: PX4 Autopilot through 1.17.0 Use-After-Free via Temperature Calibration Task Startup third-party-advisory