CVE-2026-32724: PX4 autopilot has a heap Use-After-Free in MavlinkShell::available() via SERIAL_CONTROL Race Condition
PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc1, a heap-use-after-free is detected in the MavlinkShell::available() function. The issue is caused by a race condition between the MAVLink receiver thread (which handles shell creation/destruction) and the telemetry sender thread (which polls the shell for available output). The issue is remotely triggerable via MAVLink SERIALCONTROL messages (ID 126), which can be sent by an external ground station or automated script. This vulnerability is fixed in 1.17.0-rc1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32724?
CVE-2026-32724 has been classified with a critical severity due to the potential for remote code execution resulting from a heap use-after-free vulnerability.
How do I fix CVE-2026-32724?
To fix CVE-2026-32724, upgrade your PX4 autopilot software to version 1.17.0-rc1 or later.
What causes the CVE-2026-32724 vulnerability?
CVE-2026-32724 is caused by a race condition in the MavlinkShell::available() function that leads to a heap use-after-free issue.
Which versions of PX4 autopilot are affected by CVE-2026-32724?
Versions of PX4 autopilot prior to 1.17.0-rc1 are affected by CVE-2026-32724.
What is MavlinkShell::available() in the context of CVE-2026-32724?
MavlinkShell::available() is a function in the PX4 autopilot that is impacted by the heap-use-after-free vulnerability identified in CVE-2026-32724.