Heap Use After Free Vulnerability in PX4 Autopilot for Drones

CVE-2026-32724

What is CVE-2026-32724?

The PX4 Autopilot, a widely utilized flight control solution for drones, has a vulnerability that allows for a heap-use-after-free condition within the MavlinkShell::available() function. This arises from a race condition between the MAVLink receiver thread and the telemetry sender thread, leading to potential remote exploitation via MAVLink SERIAL_CONTROL messages. The flaw can be triggered by an external ground station or automated script, emphasizing the need for prompt updates to version 1.17.0-rc1 where this issue is resolved.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References