VYPR
← All advisories
Medium severity5.3NVD Advisory· Published Mar 16, 2026· Updated Jun 17, 2026

CVE-2026-32724

CVE-2026-32724

Description

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc1, a heap-use-after-free is detected in the MavlinkShell::available() function. The issue is caused by a race condition between the MAVLink receiver thread (which handles shell creation/destruction) and the telemetry sender thread (which polls the shell for available output). The issue is remotely triggerable via MAVLink SERIAL_CONTROL messages (ID 126), which can be sent by an external ground station or automated script. This vulnerability is fixed in 1.17.0-rc1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

5
  • Dronecode/Px4 Drone Autopilot3 versions
    cpe:2.3:a:dronecode:px4_drone_autopilot:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:dronecode:px4_drone_autopilot:*:*:*:*:*:*:*:*range: <1.17.0
    • cpe:2.3:a:dronecode:px4_drone_autopilot:1.17.0:alpha1:*:*:*:*:*:*
    • cpe:2.3:a:dronecode:px4_drone_autopilot:1.17.0:beta1:*:*:*:*:*:*
  • Px4/Px4 Autopilotllm-fuzzy2 versions
    <1.17.0-rc1+ 1 more
    • (no CPE)range: <1.17.0-rc1
    • (no CPE)range: < 1.17.0-rc1

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.