# CVE-2026-86096: PX4 Autopilot use-after-free in TemperatureCalibration

Source: https://junglewise.ai/threats/cve-2026-86096-px4-autopilot-use-after-free-in-temperaturecalibration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86096 · Severity: medium · CVSS 5.9 · Published 2026-09-04

PX4 Autopilot is flight control software used in unmanned aircraft and drones. A race condition in the temperature calibration module allows an attacker with shell access to trigger a use-after-free vulnerability, corrupting memory and potentially causing system instability or crashes that could compromise vehicle control.

Technologies: [Px4 Autopilot](https://junglewise.ai/threats/technologies/autopilot). Vendors: [Px4](https://junglewise.ai/threats/vendors/px4).

## Quick answers

**Is CVE-2026-86096 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86096 being exploited in the wild.

**How severe is CVE-2026-86096?** Medium severity, with a CVSS score of 5.9, published 4 September 2026.

**Which products and versions are affected?** Px4 Autopilot through 1.17.0.

**Is there a fix for CVE-2026-86096?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-86096 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2026-86096?** Check whether you run Px4 Autopilot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a use-after-free in the TemperatureCalibration::start() function caused by a race condition between task spawning and object deletion. An attacker can invoke the calibration process via shell commands, leading to writes to freed heap memory. This corrupts unrelated heap objects and allocator metadata, destabilizing heap operations. The vulnerability affects PX4 Autopilot through version 1.17.0 and requires local shell access to trigger.

## Affected products

- PX4 Autopilot through 1.17.0

## Timeline

- 2026-09-04: disclosed

## References

- [https://github.com/PX4/PX4-Autopilot](https://github.com/PX4/PX4-Autopilot)
- [https://github.com/PX4/PX4-Autopilot/blob/v1.17.0/src/modules/temperature_compensation/temperature_calibration/task.cpp](https://github.com/PX4/PX4-Autopilot/blob/v1.17.0/src/modules/temperature_compensation/temperature_calibration/task.cpp)

## Related threats

- [PX4 Autopilot stack overflow in file2 test command](https://junglewise.ai/threats/cve-2026-102809-px4-autopilot-through-1-17-0-contains-an-uncontrolled-stack)
- [PX4 Autopilot NULL pointer dereference in sd_stress command](https://junglewise.ai/threats/cve-2026-102808-px4-autopilot-through-1-17-0-contains-a-null-pointer-dereference)
- [PX4 Autopilot stack buffer over-read in netman command](https://junglewise.ai/threats/cve-2026-86714-px4-autopilot-stack-buffer-over-read-in-netman-command)
- [PX4 Autopilot use-after-free in load_mon module](https://junglewise.ai/threats/cve-2026-86713-px4-autopilot-use-after-free-in-load-mon-module)
- [PX4 Autopilot null pointer dereference in param_set_default_file](https://junglewise.ai/threats/cve-2026-86097-px4-autopilot-null-pointer-dereference-in-param-set-default-file)