CVE-2026-86096 json
PX4 Autopilot through 1.17.0 Use-After-Free via Temperature Calibration Task Startup
published 2026-09-04 2 mo ago modified 2026-09-10 59 d ago also EUVD-2026-71789
- cvss
- 5.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 26%
- public exploits
- 0
- none known
Summary
PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start() due to a race condition between task spawning and object deletion. Attackers can trigger the calibration process via shell commands to write to freed heap memory, corrupting unrelated objects or allocator metadata and destabilizing heap operations.
Patch / fix
- github.com/PX4/PX4-Autopilot@b182e52 commit
- github.com/PX4/PX4-Autopilot#28487 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 59 d ago
Exploit prediction
0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.0 | CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 5.9 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H |
| CNA | 4.0 | 6.0 | CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- PX4 PX4-Autopilot
Classification
- Weakness
-
- CWE-416 Use After Free
References
-
github.com
/PX4/PX4-Autopilot/pull/28487
patch, issue-tracking
-
github.com
/PX4/PX4-Autopilot/commit/b182e523d154fe029a49b48bb5f9d3d6693bc6bb
patch
-
github.com
/PX4/PX4-Autopilot
product
-
github.com
/PX4/PX4-Autopilot/blob/v1.17.0/src/modules/temperature_compensation/temperature_calibration/task.cpp
technical-description
-
vulncheck.com
/advisories/px4-autopilot-through-1.17.0-use-after-free-via-temperature-calibration-task-startup
third-party-advisory
Sources
- CVE List CVE-2026-86096
- NVD CVE-2026-86096
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.