Medium severity5.9NVD Advisory· Published Sep 4, 2026
CVE-2026-86096
CVE-2026-86096
Description
PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start() due to a race condition between task spawning and object deletion. Attackers can trigger the calibration process via shell commands to write to freed heap memory, corrupting unrelated objects or allocator metadata and destabilizing heap operations.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=1.17.0
Patches
Vulnerability mechanics
References
4- github.com/PX4/PX4-Autopilot/blob/v1.17.0/src/modules/temperature_compensation/temperature_calibration/task.cppnvd
- github.com/PX4/PX4-Autopilot/commit/b182e523d154fe029a49b48bb5f9d3d6693bc6bbnvd
- github.com/PX4/PX4-Autopilot/pull/28487nvd
- www.vulncheck.com/advisories/px4-autopilot-through-1.17.0-use-after-free-via-temperature-calibration-task-startupnvd
News mentions
0No linked articles in our index yet.