CVE-2026-86713

PX4 Autopilot through 1.17.0 Use-After-Free in load_mon

Published Sep 8, 2026 CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Description

PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the load_mon module's stop path where exit_and_cleanup() deletes the LoadMon object and frees the performance counter before perf_end() attempts to access it. Attackers can trigger this vulnerability by issuing the load_mon stop command from any PXH or MAVLink shell, causing reads and writes through freed memory that corrupt heap objects and destabilize the flight stack.

Analysis

Technical impact

PX4 Autopilot up to version 1.17.0 contains a use‑after‑free flaw in the load_mon module’s stop path. When the stop command is processed, the LoadMon object is destroyed and its performance counter freed before the cleanup routine still tries to access that memory. This leads to reads and writes on freed memory, corrupting heap objects and destabilizing the flight stack. The primary consequence is the potential for an attacker to execute arbitrary code or cause a crash, compromising the mission integrity and safety of the vehicle.

Affected Systems

PX4 Autopilot for any build through version 1.17.0. The vendor is PX4, product PX4 Autopilot. Devices running this software are affected unless updated beyond that version.

Risk and Exploitability

The CVSS score of 7.1 denotes a high severity. The EPSS score is not available, and the vulnerability is not currently listed in CISA’s KEV catalog. Attackers can trigger the flaw by issuing the load_mon stop command through any PXH or MAVLink shell. This indicates a remote reachability vector requiring access to the PX4 communication interfaces, making the vulnerability exploitable in air‑borne or ground‑based configurations where MAVLink commands are accepted.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

PX4

PX4-Autopilot

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.17.0

No data.

Vendor Product Versions

Px4

Autopilot

Version	Status	Scheme	Platform
`[0,1.17.0]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the PX4 firmware to a version newer than 1.17.0 where the load_mon use‑after‑free flaw is fixed.
If upgrading is not immediately possible, disable the load_mon module or remove it from the build configuration to eliminate the stop command path.
Restrict access to PXH and MAVLink shells or enforce encrypted communication so that only authenticated operators can issue the load_mon stop command.

Generated by OpenCVE AI on September 8, 2026 at 12:52 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.384% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/PX4/PX4-Autopilot
https://github.com/PX4/PX4-Autopilot/blob/v1.17.0/src/modules/load_mon/LoadMon.cpp
https://github.com/PX4/PX4-Autopilot/commit/354823e2efd8dd7ac47f4b8984b8e0fb06dc3b79
https://github.com/PX4/PX4-Autopilot/pull/28544
https://www.vulncheck.com/advisories/px4-autopilot-through-1.17.0-use-after-free-in-load-mon

History

Sep 8, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 8, 2026 11:30 AM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the load_mon module's stop path where exit_and_cleanup() deletes the LoadMon object and frees the performance counter before perf_end() attempts to access it. Attackers can trigger this vulnerability by issuing the load_mon stop command from any PXH or MAVLink shell, causing reads and writes through freed memory that corrupt heap objects and destabilize the flight stack.
Title		PX4 Autopilot through 1.17.0 Use-After-Free in load_mon
First Time appeared		Px4 Px4 autopilot
Weaknesses		CWE-416
CPEs		cpe:2.3:a:px4:autopilot::::::::
Vendors & Products		Px4 Px4 autopilot
References		https://github.com/PX4/PX4-Autopilot https://github.com/PX4/PX4-Autopilot/blob/v1.17.0/src/modules/load_mon/LoadMon.cpp https://github.com/PX4/PX4-Autopilot/commit/354823e2efd8dd7ac47f4b8984b8e0fb06dc3b79 https://github.com/PX4/PX4-Autopilot/pull/28544 https://www.vulncheck.com/advisories/px4-autopilot-through-1.17.0-use-after-free-in-load-mon
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'}` cvssV4_0 `{'score': 7.1, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N'}`