CVE-2026-86713: PX4 Autopilot through 1.17.0 Use-After-Free in load_mon
PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the loadmon module's stop path where exitandcleanup() deletes the LoadMon object and frees the performance counter before perfend() attempts to access it. Attackers can trigger this vulnerability by issuing the loadmon stop command from any PXH or MAVLink shell, causing reads and writes through freed memory that corrupt heap objects and destabilize the flight stack.
Affected Software
Event History
Frequently Asked Questions
Which interfaces should be treated as exposure points during triage?
The vulnerable stop path can be triggered by issuing the load_mon stop command from a PXH shell or a MAVLink shell. Systems that expose either shell interface should be assessed for access to that command.
What is the expected impact if the vulnerable path is triggered?
The use-after-free causes reads and writes through freed memory, which can corrupt heap objects and destabilize the flight stack. The reported impact includes integrity loss and high availability impact.