Security Advisory

CVE-2026-86713

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-09-08 11:23:05

Last updated 2026-09-08 12:20:00

Assigner VulnCheck

CVSS score 7.1

State PUBLISHED

Description

PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the load_mon module's stop path where exit_and_cleanup() deletes the LoadMon object and frees the performance counter before perf_end() attempts to access it. Attackers can trigger this vulnerability by issuing the load_mon stop command from any PXH or MAVLink shell, causing reads and writes through freed memory that corrupt heap objects and destabilize the flight stack.

← Browse all CVEs View on cve.org ↗