PX4 Autopilot contains a heap-use-after-free vulnerability in the MavlinkShell::available() function; the flaw arises from a race condition between the MAVLink receiver thread and the telemetry sender thread, enabling improper deallocation of shell memory. This can lead to memory corruption, potentially causing a system crash or other integrity violations as the impacted firmware is not correctly initialized.

The vulnerability applies to PX4 Autopilot firmware versions released prior to 1.17.0-rc1, including the 1.17.0 alpha1 and beta1 releases, as well as all earlier builds. The affected vendor is PX4:PX4-Autopilot.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% reflects a low likelihood of exploitation. The issue is not listed in the CISA KEV catalog. It is remotely triggerable via MAVLink SERIAL_CONTROL (ID 126) messages that can be sent from any external ground station or script, but exploiting the race condition requires precise timing of MAVLink packets. Considering the moderate impact and low probability, patching remains the most prudent response.