The vulnerability is a use‑after‑free that arises during TemperatureCalibration::start() because a task is spawned before the object it references is fully constructed or deleted. An attacker can trigger the calibration process with shell commands, causing the program to write to memory that has already been freed, corrupting unrelated objects or allocator metadata. This corruption can lead to arbitrary code execution or widespread service disruption.

The flaw affects PX4 Autopilot version 1.17.0 and earlier, delivered under the PX4 project umbrella.

The CVSS score of 6 indicates medium severity. The exploitation requires that an attacker can execute shell commands in the environment running the autopilot firmware, which typically means local access or a remotely exploitable command interface. The EPSS score is not available, and the issue is not listed in CISA KEV, suggesting that, while the risk is moderate, it is not currently widely exploited. The likely attack vector is a local attacker who can issue the shell command that launches the calibration task at startup.