PX4 Autopilot through 1.17.0 Use-After-Free via Temperature Calibration Task Startup

Versions reported by the vendor

Affected version ranges reported by the assigning authority (VulnCheck). Independent of NVD's CPE analysis and usually ahead of it.

• PX4 PX4-Autopilot

  • up to and including 1.17.0affected · semver

Other highest-scoring records for the same primary product.

• CVE-2026-102809PX4 Autopilot through 1.17.0 Stack Exhaustion via tests file2 Command
  28Monitor
• CVE-2026-102808PX4 Autopilot through 1.17.0 NULL Pointer Dereference via sd_stress
  28Monitor
• CVE-2026-86713PX4 Autopilot through 1.17.0 Use-After-Free in load_mon
  28Monitor
• CVE-2026-86097PX4 Autopilot through 1.17.0 Null Pointer Dereference via param select
  28Monitor
• CVE-2026-84698PX4 Autopilot sd_bench Heap Buffer Overflow via Block Size
  28Monitor
• CVE-2026-86714PX4 Autopilot through 1.17.0 Stack Buffer Over-read via netman
  21Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.