CVE-2026-86096
🔶 mediumSummary
PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start() due to a race condition between task spawning and object deletion. Attackers can trigger the calibration process via shell commands to write to freed heap memory, corrupting unrelated objects or allocator metadata and destabilizing heap operations.
CVSS Score
5.9
Medium
EPSS Score
0.2
Exploit Probability
Published Date
2026-09-04
First Seen: 2026-09-05
📊 Relative Risk Intelligence
This CVE is Lower Risk - more severe than 32.3% of all 353,061 vulnerabilities in our database.
#238,970
Below average severity
Severity Percentile
Last Modified
2026-09-04
Source
NVD 🔗
CVSS Vector 3.1
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
CVSS Vector 4.0
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE IDs (Weakness Types)