EUVD-2026-71789
GHSA-9rqw-c6c2-rwvv
Severity by source
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent access required with high complexity due to race condition; PR:N consistent with provided CVSS 4.0; availability high from heap destabilization, integrity low, no confidentiality impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start() due to a race condition between task spawning and object deletion. Attackers can trigger the calibration process via shell commands to write to freed heap memory, corrupting unrelated objects or allocator metadata and destabilizing heap operations.
AnalysisAI
Use-after-free in PX4 Autopilot through v1.17.0 permits adjacent attackers with shell access to corrupt the autopilot's heap by racing task spawning against object deletion in the temperature calibration subsystem. The root cause is that TemperatureCalibration::start() stores the spawned task handle in an instance member variable; if the object is freed before the spawned task begins execution, the task writes into dangling heap memory, corrupting adjacent allocator metadata or unrelated objects. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) adjacent-network or local shell access to the autopilot (via MAVLink console, NuttX NSH over UART/USB, or SSH on Linux-target builds); (2) the ability to invoke the temperature calibration start command through that shell; (3) successful timing of a race condition between `px4_task_spawn_cmd()` returning and the `TemperatureCalibration` object being deleted - the AT:P (Attack Requirements: Present) metric in the CVSS 4.0 vector reflects this specific race-window precondition. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is moderate, bounded primarily by the adjacent-access requirement and the race-condition timing constraint. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fix from GitHub commit b182e523d154fe029a49b48bb5f9d3d6693bc6bb (PR #28487: https://github.com/PX4/PX4-Autopilot/pull/28487). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Px4 Autopilot
View allStack overflow vulnerability in PX4 autopilot drone flight control software (versions prior to 1.17.0-rc2) where the Zen
Null pointer dereference in PX4 Autopilot through 1.17.0 allows any party with PX4 shell access to crash the autopilot p
Buffer overflow vulnerability in PX4 autopilot drone firmware versions before 1.17.0-rc2 that allows adjacent network at
Use-after-free in PX4 Autopilot through 1.17.0 allows an adjacent unauthenticated attacker to corrupt flight-stack heap
PX4 autopilot versions prior to 1.17.0-rc2 contain a stack overflow vulnerability in the BST telemetry probe driver that
An unauthenticated path traversal vulnerability in PX4 Autopilot's MAVLink FTP implementation (CWE-22) allows any MAVLin
Stack buffer over-read in PX4 Autopilot through v1.17.0 exposes stack memory via the netman system command's interface n
PX4 Autopilot versions prior to 1.17.0-rc1 contain a heap-use-after-free vulnerability in the MavlinkShell::available()
PX4 autopilot versions prior to 1.17.0-rc2 contain an unbounded memcpy vulnerability in the tattu_can module that allows
PX4 Autopilot prior to version 1.17.0-rc2 contains a boolean logic error in MAVLink FTP session validation that uses AND
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today