CVE-2026-86713

PX4 Autopilot versions through 1.17.0 contain a use-after-free (CWE-416) in the load_mon module's stop path, where exit_and_cleanup() deletes the LoadMon object and frees its performance counter before perf_end() accesses it. The flaw is triggered by issuing the 'load_mon stop' command from any PXH or MAVLink shell, causing reads and writes through freed memory. The resulting heap corruption can destabilize or crash the flight stack, and the CVSS 4.0 score of 7.1 (High) reflects an adjacent-network attack vector with high availability impact on the affected flight controller. Anyone running PX4 Autopilot firmware up to and including 1.17.0 is affected, although exploitation requires the ability to send shell commands over a serial, USB, or MAVLink telemetry link. No public proof-of-concept exists, the flaw is not in CISA's KEV, and EPSS estimates the 30-day exploitation probability at 0.4%.

What to do: Upgrade flight controllers to a patched PX4 release newer than 1.17.0 as soon as one is available, since all builds through 1.17.0 are affected. Until patched, avoid issuing 'load_mon stop' from PXH or MAVLink shells and restrict shell/MAVLink access on telemetry links to trusted, authenticated users. Inventory your fleet by firmware version to identify which airframes run PX4 1.17.0 or earlier.