401 matches found
EUVD-2026-71789
PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start due to a race condition between task spawning and object deletion. Attackers can trigger the calibration process via shell commands to write to freed heap memory, corrupting unrelated objects or...
CVE-2026-86097
PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in paramsetdefaultfile and paramsetbackupfile functions that allows attackers to crash the autopilot process. Attackers can invoke 'param select' or 'param select-backup' commands with no path argument from any PX4 she...
CVE-2026-86096
PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start due to a race condition between task spawning and object deletion. Attackers can trigger the calibration process via shell commands to write to freed heap memory, corrupting unrelated objects or...
CVE-2026-86097 PX4 Autopilot through 1.17.0 Null Pointer Dereference via param select
PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in paramsetdefaultfile and paramsetbackupfile functions that allows attackers to crash the autopilot process. Attackers can invoke 'param select' or 'param select-backup' commands with no path argument from any PX4 she...
CVE-2026-86097
PX4 Autopilot through 1.17.0 contains a null pointer dereference in the param_set_default_file() and param_set_backup_file() functions. An attacker with access to any PX4 shell can trigger the crash by issuing param select or param select-backup with no path argument , causing the autopilot proce...
CVE-2026-86097 PX4 Autopilot through 1.17.0 Null Pointer Dereference via param select
PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in paramsetdefaultfile and paramsetbackupfile functions that allows attackers to crash the autopilot process. Attackers can invoke 'param select' or 'param select-backup' commands with no path argument from any PX4 she...
CVE-2026-86096
PX4 Autopilot through version 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start() within the temperature_compensation module. The root cause is a race condition between task spawning and object deletion, allowing an attacker on an adjacent network to trigger the cali...
CVE-2026-86096 PX4 Autopilot through 1.17.0 Use-After-Free via Temperature Calibration Task Startup
PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start due to a race condition between task spawning and object deletion. Attackers can trigger the calibration process via shell commands to write to freed heap memory, corrupting unrelated objects or...
CVE-2026-86096 PX4 Autopilot through 1.17.0 Use-After-Free via Temperature Calibration Task Startup
PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start due to a race condition between task spawning and object deletion. Attackers can trigger the calibration process via shell commands to write to freed heap memory, corrupting unrelated objects or...
PT-2026-86267
PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in param set default file and param set backup file functions that allows attackers to crash the autopilot process. Attackers can invoke 'param select' or 'param select-backup' commands with no path argument from any P...
PT-2026-86266
PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start due to a race condition between task spawning and object deletion. Attackers can trigger the calibration process via shell commands to write to freed heap memory, corrupting unrelated objects or...
CVE-2026-84698
PX4 Autopilot contains a heap buffer overflow vulnerability in the sdbench command that writes a four-byte block number into a user-supplied sized allocation. Attackers can invoke sdbench with a block size below four bytes to overflow the heap buffer and potentially execute code or crash the syst...
CVE-2026-84698 PX4 Autopilot sd_bench Heap Buffer Overflow via Block Size
PX4 Autopilot contains a heap buffer overflow vulnerability in the sdbench command that writes a four-byte block number into a user-supplied sized allocation. Attackers can invoke sdbench with a block size below four bytes to overflow the heap buffer and potentially execute code or crash the syst...
EUVD-2026-69789
PX4 Autopilot contains a heap buffer overflow vulnerability in the sdbench command that writes a four-byte block number into a user-supplied sized allocation. Attackers can invoke sdbench with a block size below four bytes to overflow the heap buffer and potentially execute code or crash the syst...
CVE-2026-84698 PX4 Autopilot sd_bench Heap Buffer Overflow via Block Size
PX4 Autopilot contains a heap buffer overflow vulnerability in the sdbench command that writes a four-byte block number into a user-supplied sized allocation. Attackers can invoke sdbench with a block size below four bytes to overflow the heap buffer and potentially execute code or crash the syst...
CVE-2026-84698
PX4 Autopilot is affected by a heap buffer overflow in the sd_bench command. The command writes a four-byte block number into a user-supplied sized allocation; invoking it with a block size below four bytes overflows the buffer, potentially allowing arbitrary code execution or a system crash . Th...
CVE-2026-65778
Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally...
CVE-2026-65780
Double free in Windows Autopilot allows an authorized attacker to elevate privileges locally...