CVE-2026-86097

PX4 Autopilot through version 1.17.0 contains a null pointer dereference (CWE-476) in the param_set_default_file() and param_set_backup_file() functions that crashes the autopilot process. An attacker with access to any PX4 shell (e.g., a MAVLink shell or serial console) can trigger the crash simply by running 'param select' or 'param select-backup' without supplying a path argument. The impact is denial of service: the autopilot process dies, and on an airborne vehicle this can disrupt flight control and potentially lead to loss of the aircraft, consistent with the high availability impact scored in the CVSS 4.0 rating of 7.1. Anyone running PX4 firmware version 1.17.0 or earlier on a drone or other UAV is affected, with practical exposure limited to vehicles whose PX4 shell is reachable by an adjacent attacker or untrusted operator. Exploitation has not been observed: there is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS puts 30-day exploitation probability at only 0.2% (16th percentile).

What to do: Restrict access to PX4 shells (MAVLink shell, serial console) to trusted operators and avoid running 'param select' or 'param select-backup' without a path argument until a fix is available. Inventory all drones and ground systems running PX4 1.17.0 or earlier, and monitor the upstream PX4 project for a patched release beyond 1.17.0; no fixed version is specified in the available data, so do not assume 1.17.0 is safe.