CVE-2026-86097 in Autopilot
Summary
by MITRE • 09/05/2026
PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in param_set_default_file() and param_set_backup_file() functions that allows attackers to crash the autopilot process. Attackers can invoke 'param select' or 'param select-backup' commands with no path argument from any PX4 shell to trigger the crash.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/05/2026
The identified vulnerability in PX4 Autopilot versions through 1.17.0 represents a critical stability issue rooted in improper input validation within the parameter management subsystem. Specifically, the flaw resides in two functions, param_set_default_file and param_set_backup_file, which are responsible for loading configuration files that define default or backup system parameters. These functions fail to verify whether a file path argument has been provided by the user before attempting to access memory associated with that path. This lack of validation creates a direct pathway for a null pointer dereference when an attacker invokes these commands without supplying the required filename parameter. The vulnerability is particularly concerning because it affects core system stability, potentially leading to a complete crash of the autopilot process during flight operations or ground testing phases where such parameters are frequently adjusted.
From a technical perspective, this issue classifies under CWE-476, which denotes NULL Pointer Dereference. When the param select command is executed without an argument, the underlying C code attempts to dereference a null pointer that was intended to hold the file path string. In embedded systems like PX4, such memory access violations typically result in immediate termination of the affected process due to segmentation faults or similar operating system protections. This behavior aligns with ATT&CK technique T1059, Command and Scripting Interpreter, as it exploits legitimate administrative commands available through the shell interface. The attack vector is local but can be triggered by any user account that has access to the PX4 shell, including potentially compromised onboard computers or ground control stations if network-based command injection vectors exist in other parts of the system architecture.
The operational impact of this vulnerability extends beyond simple process termination. In the context of unmanned aerial vehicles and autonomous systems, a crash in the autopilot module can lead to loss of vehicle control, depending on the fail-safe mechanisms implemented by the specific flight stack configuration. If the main loop or critical monitoring tasks depend on the parameter subsystem remaining active, a crash could trigger emergency landing procedures or cause the system to enter an undefined state. This poses significant risks to safety-critical applications where continuous operation is required. Furthermore, because this vulnerability can be triggered via standard shell commands, it does not require complex exploitation techniques or privilege escalation beyond basic command execution capabilities, making it accessible to a wide range of potential threat actors who have gained access to the system interface.
Mitigation strategies for this vulnerability primarily involve updating the PX4 Autopilot software to versions later than 1.17.0, where developers have implemented proper input validation checks within param_set_default_file and param_set_backup_file. These updates ensure that functions verify the presence of a valid file path before proceeding with memory allocation or file operations. In environments where immediate patching is not feasible, operational mitigations include restricting shell access to trusted personnel only and implementing strict command filtering at the gateway level if remote execution capabilities exist. Additionally, developers should enforce principle of least privilege by limiting which users can execute parameter modification commands. Regular security audits focusing on input validation in embedded system interfaces are recommended to prevent similar null pointer dereference issues from arising in other components of the flight stack.