VULNERABILITY INTELLIGENCE
CVE-2026-86096
CVSS score6 MEDIUM
EPSS probability0.33%
CISA KEVNot currently listed
Published2026-09-04
Last modified2026-09-10
CVSS vectorCVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Description
PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start() due to a race condition between task spawning and object deletion. Attackers can trigger the calibration process via shell commands to write to freed heap memory, corrupting unrelated objects or allocator metadata and destabilizing heap operations.
Weakness classification
- CWE-416: Use After Free