High severity8.1NVD Advisory· Published Mar 10, 2026· Updated Jun 17, 2026
CVE-2026-26742
CVE-2026-26742
Description
PX4 Autopilot versions 1.12.x through 1.15.x contain a protection mechanism failure in the "Re-arm Grace Period" logic. The system incorrectly applies the in-air emergency re-arm logic to ground scenarios. If a pilot switches to Manual mode and re-arms within 5 seconds (default configuration) of an automatic landing, the system bypasses all pre-flight safety checks, including the throttle threshold check. This allows for an immediate high-thrust takeoff if the throttle stick is raised, leading to loss of control.
Affected products
3- cpe:2.3:a:dronecode:px4_drone_autopilot:*:*:*:*:*:*:*:*Range: >=1.12.0,<1.16.0
(expand)+ 1 more
- (no CPE)
- (no CPE)range: 1.12.x - 1.15.x
Patches
Vulnerability mechanics
References
1- github.com/npuwyw/PX4-Autopilot/blob/audit-v1.12.3-mode-transition-logic-flaw/PX4_Autopilot_Mode_Switching_Logic_Vulnerability.mdnvdExploitMitigationVendor Advisory
News mentions
0No linked articles in our index yet.