CVE-2026-86096: PX4 Autopilot through 1.17.0 Use-After-Free via Temperature Calibration Task Startup
PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start() due to a race condition between task spawning and object deletion. Attackers can trigger the calibration process via shell commands to write to freed heap memory, corrupting unrelated objects or allocator metadata and destabilizing heap operations.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker needs the ability to invoke PX4 shell commands that start the temperature calibration process. The provided vector lists no privileges and no user interaction requirements, but exploitation still depends on access to that command interface.
What is the likely operational impact?
A successful race can cause writes to freed heap memory, potentially corrupting unrelated objects or allocator metadata. This can destabilize heap operations and cause a denial of service; the supplied severity vector also indicates low integrity impact.
Which versions should be considered affected?
PX4 Autopilot versions through 1.17.0 are identified as affected. The provided information does not specify the first fixed release.