Use-After-Free Vulnerability in PX4 Autopilot Software by PX4

CVE-2026-86096

What is CVE-2026-86096?

The PX4 Autopilot software, up to version 1.17.0, is vulnerable to a use-after-free issue arising from a race condition in the TemperatureCalibration::start() function. This vulnerability allows attackers to exploit the calibration process through shell commands, leading to the potential for writing to freed heap memory. Such actions can corrupt unrelated data objects and compromise allocator metadata, which may destabilize heap operations within the software, making it susceptible to further attacks or system instability.

References