CVE-2026-86096 json
PX4 Autopilot through 1.17.0 Use-After-Free via Temperature Calibration Task Startup
published 2mo ago modified 2mo ago also EUVD-2026-71789
- cvss
- 5.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 26%
- public exploits
- 0
- none known
Summary
PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start() due to a race condition between task spawning and object deletion. Attackers can trigger the calibration process via shell commands to write to freed heap memory, corrupting unrelated objects or allocator metadata and destabilizing heap operations.
Patch / fix
- dronecode px4_drone_autopilot 1.18.0
- github.com/PX4/PX4-Autopilot@b182e52 commit
- github.com/PX4/PX4-Autopilot#28487 pull request
Is CVE-2026-86096 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2mo ago
Exploit prediction
0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.0 | CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 5.9 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H |
| CNA | 4.0 | 6.0 | CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- PX4 PX4-Autopilot
Classification
- Weakness
-
- CWE-416 Use After Free
References
-
github.com
/PX4/PX4-Autopilot/pull/28487
patch, issue-tracking
-
github.com
/PX4/PX4-Autopilot/commit/b182e523d154fe029a49b48bb5f9d3d6693bc6bb
patch
-
github.com
/PX4/PX4-Autopilot
product
-
github.com
/PX4/PX4-Autopilot/blob/v1.17.0/src/modules/temperature_compensation/temperature_calibration/task.cpp
technical-description
-
vulncheck.com
/advisories/px4-autopilot-through-1.17.0-use-after-free-via-temperature-calibration-task-startup
third-party-advisory
Sources
- CVE List CVE-2026-86096
- NVD CVE-2026-86096
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.