CVE-2026-86713CWE-416

CVE-2026-86713

High · published September 8, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
31.2
In the wild
Unconfirmed
What it is

PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the load_mon module's stop path where exit_and_cleanup() deletes the LoadMon object and frees the performance counter before perf_end() attempts to access it. Attackers can trigger this vulnerability by issuing the load_mon stop command from any PXH or MAVLink shell, causing reads and writes through freed memory that corrupt heap objects and destabilize the flight stack.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
CVSS v4.0
7.1 · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
EPSS
0.00384 · 31.2th percentile
Weakness
CWE-416 · Use After Free
Published
2026-09-08T16:17Z
References (6)
https://github.com/PX4/PX4-Autopilot · [email protected]https://github.com/PX4/PX4-Autopilot/blob/v1.17.0/src/modules/load_mon/LoadMon.cpp · [email protected]https://github.com/PX4/PX4-Autopilot/commit/354823e2efd8dd7ac47f4b8984b8e0fb06dc3b79 · [email protected]https://github.com/PX4/PX4-Autopilot/pull/28544 · [email protected]https://www.vulncheck.com/advisories/px4-autopilot-through-1.17.0-use-after-free-in-load-mon · [email protected]https://github.com/PX4/PX4-Autopilot/pull/28544 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 10 SEP 03:18Z
    EPSS moved — → 0%
    epss
  • 08 SEP 11:23Z
    PX4 Autopilot through 1.17.0 Use-After-Free in load_mon
    cvelistv5