CVE-2025-9020— PX4 PX4-Autopilot Mavlink Shell Closing mavlink_receiver.cpp handle_message_serial_control use after free
Quick assessment
Affected
PX4 PX4-Autopilot
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PX4 Drone Autopilot是PX4 Autopilot开源的一个 PX4 无人机自动驾驶仪。 PX4 Drone Autopilot 1.15.4及之前版本存在资源管理错误漏洞，该漏洞源于MavlinkReceiver::handle_message_serial_control函数对参数_mavlink_shell处理不当，导致释放后重用。
Possible ATT&CK Techniques 2 AI
T1203 · Exploitation for Client Execution T1211 · Exploitation for Stealth
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-9020
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PX4 PX4-Autopilot Mavlink Shell Closing mavlink_receiver.cpp handle_message_serial_control use after free
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was found in PX4 PX4-Autopilot up to 1.15.4. This issue affects the function MavlinkReceiver::handle_message_serial_control of the file src/modules/mavlink/mavlink_receiver.cpp of the component Mavlink Shell Closing Handler. The manipulation of the argument _mavlink_shell leads to use after free. An attack has to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The identifier of the patch is 4395d4f00c49b888f030f5b43e2a779f1fa78708. It is recommended to apply a patch to fix this issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
释放后使用
Source: CVE Program / CVE List V5
Vulnerability Title
PX4 Drone Autopilot 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
PX4 Drone Autopilot是PX4 Autopilot开源的一个 PX4 无人机自动驾驶仪。 PX4 Drone Autopilot 1.15.4及之前版本存在资源管理错误漏洞，该漏洞源于MavlinkReceiver::handle_message_serial_control函数对参数_mavlink_shell处理不当，导致释放后重用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| PX4 | PX4-Autopilot | 1.15.0 | - |
|
II. Public POCs for CVE-2025-9020
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-9020
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: PX4-Autopilot
-
CVE-2026-32743
PX4 Autopilot: Stack-based Buffer Overflow via Oversized Pat -
CVE-2026-32724
PX4 autopilot has a heap Use-After-Free in MavlinkShell::ava -
CVE-2026-32713
PX4 Autopilot MAVLink FTP Session Validation Logic Error All -
CVE-2026-32709
PX4 Autopilot MAVLink FTP Unauthenticated Path Traversal (Ar -
CVE-2026-32708
Zenoh uORB Subscriber Allows Arbitrary Stack Allocation (PX4
Same vendor: PX4
-
CVE-2026-1579
PX4 Autopilot Missing authentication for critical function -
CVE-2026-32743
PX4 Autopilot: Stack-based Buffer Overflow via Oversized Pat -
CVE-2026-32724
PX4 autopilot has a heap Use-After-Free in MavlinkShell::ava -
CVE-2026-32713
PX4 Autopilot MAVLink FTP Session Validation Logic Error All -
CVE-2026-32709
PX4 Autopilot MAVLink FTP Unauthenticated Path Traversal (Ar
Same weakness: CWE-416
-
CVE-2026-77235
Missing privilege check in SecureContext_FreeContext in Free -
CVE-2026-39909
llama.cpp Use-After-Free in RPC GRAPH_RECOMPUTE Handler -
CVE-2026-17118
Vulnerabilities in IBM AIX and PowerVM VIOS -
CVE-2026-76021
Chrome <151.0.7922.173 DOM UAF远程代码执行 -
CVE-2026-76017
Chrome<151.0.7922.173 Chromoting Use-After-Free致代码执行
V. Comments for CVE-2025-9020
No comments yet