CVE-2026-86097— PX4 Autopilot through 1.17.0 Null Pointer Dereference via param select
Quick assessment
Affected
PX4 PX4-Autopilot
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PX4 自动飞行控制器（Autopilot）1.17.0 及更早版本存在空指针解引用漏洞，位于 和 函数中。该漏洞允许攻击者使自动飞行控制器进程崩溃。攻击者可以在任何 PX4 shell 中执行 或 命令时不传路径参数，从而触发崩溃。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86097
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PX4 Autopilot through 1.17.0 Null Pointer Dereference via param select
Source: CVE Program / CVE List V5
Vulnerability Description
PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in param_set_default_file() and param_set_backup_file() functions that allows attackers to crash the autopilot process. Attackers can invoke 'param select' or 'param select-backup' commands with no path argument from any PX4 shell to trigger the crash.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
空指针解引用
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| PX4 | PX4-Autopilot | 0 ~ 1.17.0 | - |
|
II. Public POCs for CVE-2026-86097
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86097
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-86097 (2)
Vendor Advisories for CVE-2026-86097 (1)
Vendor Pages for CVE-2026-86097 (1)
IV. Related Vulnerabilities
Same product: PX4-Autopilot
-
CVE-2026-86096
PX4 Autopilot through 1.17.0 Use-After-Free via Temperature -
CVE-2026-84698
PX4 Autopilot sd_bench Heap Buffer Overflow via Block Size -
CVE-2026-32743
PX4 Autopilot: Stack-based Buffer Overflow via Oversized Pat -
CVE-2026-32724
PX4 autopilot has a heap Use-After-Free in MavlinkShell::ava -
CVE-2026-32713
PX4 Autopilot MAVLink FTP Session Validation Logic Error All
Same vendor: PX4
-
CVE-2026-86096
PX4 Autopilot through 1.17.0 Use-After-Free via Temperature -
CVE-2026-84698
PX4 Autopilot sd_bench Heap Buffer Overflow via Block Size -
CVE-2026-1579
PX4 Autopilot Missing authentication for critical function -
CVE-2026-32743
PX4 Autopilot: Stack-based Buffer Overflow via Oversized Pat -
CVE-2026-32724
PX4 autopilot has a heap Use-After-Free in MavlinkShell::ava
Same weakness: CWE-476
-
CVE-2026-80118
PassMark PerformanceTest, BurnInTest, and OSForensics Kernel -
CVE-2026-17273
IBM i is Affected By Multiple Vulnerabilities in Debug Serve -
CVE-2026-85150
Gstreamer1-plugins-base: gstreamer: null/invalid-pointer der -
CVE-2026-17539
Hitachi RTU500 异常处理不当漏洞 -
CVE-2026-78222
NGINX ngx_http_js_module vulnerability
V. Comments for CVE-2026-86097
No comments yet