CVE-2026-86097: PX4 Autopilot through 1.17.0 Null Pointer Dereference via param select
PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in paramsetdefaultfile() and paramsetbackupfile() functions that allows attackers to crash the autopilot process. Attackers can invoke 'param select' or 'param select-backup' commands with no path argument from any PX4 shell to trigger the crash.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to trigger the crash?
No authentication or privileges are required, but the attacker must be able to run commands from a PX4 shell. They can trigger the issue by invoking `param select` or `param select-backup` without a path argument.
What is the operational impact of successful exploitation?
Successful exploitation crashes the autopilot process, resulting in a denial-of-service condition. The provided data does not indicate confidentiality or integrity impact.
Which versions are known to be affected?
PX4 Autopilot versions through 1.17.0 are affected. The provided information does not identify the first fixed release.