Description

PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the load_mon module's stop path where exit_and_cleanup() deletes the LoadMon object and frees the performance counter before perf_end() attempts to access it. Attackers can trigger this vulnerability by issuing the load_mon stop command from any PXH or MAVLink shell, causing reads and writes through freed memory that corrupt heap objects and destabilize the flight stack.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-08T12:17:00.150Z",
  "pubdate": "2026-09-08T12:17:00.150Z",
  "executiveSummary": "A use-after-free vulnerability exists in the load_mon module of PX4 Autopilot versions up to 1.17.0. The vulnerability stems from an improper object lifecycle management process within the module's shutdown sequence. Specifically, the exit_and_cleanup() function deallocates the LoadMon object and associated performance counters while a subsequent operation, perf_end(), attempts to access the memory address of the freed performance counter.\nThis vulnerability allows an attacker with access to the PXH (PX4 Shell) or MAVLink command interface to trigger a heap-based memory corruption. Successful exploitation leads to undefined behavior within the flight stack, which can result in service instability, potential code execution, or system crashes. Given that the flight stack is critical for vehicle stability, the risk implication is severe, potentially leading to loss of control during flight operations. There are no authentication requirements if an attacker has established a MAVLink connection or physical shell access, making this an accessible target for malicious actors capable of interacting with the autopilot's command-line interface.",
  "technicalDetails": "The vulnerability resides within the load_mon module, which is responsible for monitoring system resource utilization on PX4 Autopilot. The flaw occurs during the stop sequence initiated via user command.\nRoot Cause: The primary issue is a race condition or logic flaw in the teardown routine located within exit_and_cleanup(). When the module is commanded to stop, the function executes a cleanup sequence that deallocates the LoadMon object. In this process, the performance counter (perf_counter) associated with the module is freed from the heap. Immediately following this deallocation, the execution flow proceeds to invoke perf_end() using a reference to the now-freed performance counter. Because the pointer to the counter is not invalidated or nullified prior to this attempt, the system performs a use-after-free (UAF) operation.\nAttack Flow: 1. Attacker sends a stop command to the load_mon module via an available interface such as the PXH shell or MAVLink shell. 2. The load_mon process initiates the exit_and_cleanup() sequence. 3. The system releases the memory block associated with the performance counter. 4. The execution thread continues to the perf_end() function, which attempts to read from or write to the memory address previously assigned to the counter. 5. The heap manager, having reclaimed or reallocated this memory block for other kernel or application objects, now contains data that does not belong to the original load_mon module.\nExploitation Method: By triggering this UAF, an attacker can cause the flight stack to perform operations on attacker-controlled or corrupted data. If the heap memory is reused by other processes before the UAF occurs, the attacker may influence the integrity of those objects, leading to unauthorized memory modification. This corruption can bypass software safety checks or destabilize critical real-time tasks handled by the flight controller.\nAffected Versions: PX4 Autopilot through version 1.17.0.\nImpact: The exploitation of this vulnerability results in memory corruption that can lead to a system panic or an unrecoverable state. In an embedded flight control environment, such instability threatens the operational safety of the aircraft, as it may interfere with the task scheduler or sensor processing loops. The vulnerability does not require high-level privileges beyond the ability to send shell or MAVLink commands to the autopilot, which are standard interfaces for configuration and telemetry."
}