Heap Use After Free Vulnerability in PX4 Autopilot for Drones

CVE-2026-32724

What is CVE-2026-32724?

The PX4 Autopilot, a widely utilized flight control solution for drones, has a vulnerability that allows for a heap-use-after-free condition within the MavlinkShell::available() function. This arises from a race condition between the MAVLink receiver thread and the telemetry sender thread, leading to potential remote exploitation via MAVLink SERIAL_CONTROL messages. The flaw can be triggered by an external ground station or automated script, emphasizing the need for prompt updates to version 1.17.0-rc1 where this issue is resolved.

References