Executive brief
PX4 Autopilot is flight control software used in unmanned aircraft and drones. A race condition in the temperature calibration module allows an attacker with shell access to trigger a use-after-free vulnerability, corrupting memory and potentially causing system instability or crashes that could compromise vehicle control.
Technical details
The vulnerability is a use-after-free in the TemperatureCalibration::start() function caused by a race condition between task spawning and object deletion. An attacker can invoke the calibration process via shell commands, leading to writes to freed heap memory. This corrupts unrelated heap objects and allocator metadata, destabilizing heap operations. The vulnerability affects PX4 Autopilot through version 1.17.0 and requires local shell access to trigger.
Affected products
- PX4 Autopilot through 1.17.0
Timeline
- 2026-09-04: disclosed