CVE-2026-32724: Dronecode PX4 Use-After-Free Vulnerability

CVE-2026-32724 Overview

CVE-2026-32724 is a heap use-after-free vulnerability in the PX4 Autopilot flight control software for drones. The vulnerability exists in the MavlinkShell::available() function and is caused by a race condition between two critical threads: the MAVLink receiver thread (responsible for shell creation and destruction) and the telemetry sender thread (which polls the shell for available output).

This vulnerability is remotely triggerable via MAVLink SERIAL_CONTROL messages (ID 126), which can be sent by an external ground station or automated script over an adjacent network connection. Successful exploitation could result in a denial-of-service condition, potentially causing drone instability or loss of control during flight operations.

Critical Impact

A race condition in PX4 Autopilot allows remote attackers on adjacent networks to trigger a heap use-after-free via crafted MAVLink SERIAL_CONTROL messages, potentially causing drone crashes or loss of control.

Affected Products

• Dronecode PX4 Drone Autopilot versions prior to 1.17.0-rc1
• Dronecode PX4 Drone Autopilot 1.17.0-alpha1
• Dronecode PX4 Drone Autopilot 1.17.0-beta1

Discovery Timeline

• 2026-03-16 - CVE CVE-2026-32724 published to NVD
• 2026-03-16 - Last updated in NVD database

Technical Details for CVE-2026-32724

Vulnerability Analysis

This vulnerability falls under CWE-416 (Use After Free), a memory corruption class that occurs when a program continues to use a pointer after it has been freed. In the context of PX4 Autopilot, the MavlinkShell::available() function is accessed by the telemetry sender thread while the MAVLink receiver thread may simultaneously destroy the shell object, leaving a dangling pointer.

The race condition arises from insufficient synchronization between these two threads. When a MAVLink SERIAL_CONTROL message triggers shell destruction in the receiver thread, the telemetry sender thread may still hold a reference to the now-freed shell object. Subsequent access to this freed memory can lead to undefined behavior, including crashes and potential memory corruption.

The adjacent network attack vector requires the attacker to be on the same network segment as the target drone's telemetry link, which is common in ground control station scenarios.

Root Cause

The root cause is a lack of proper thread synchronization between the MAVLink receiver thread and the telemetry sender thread when handling shell lifecycle operations. The shell object can be deallocated by one thread while another thread is actively polling it through MavlinkShell::available(), creating a classic use-after-free condition due to missing mutex locks or atomic reference counting.

Attack Vector

The attack can be executed remotely from an adjacent network by sending specially crafted MAVLink SERIAL_CONTROL messages (message ID 126) to the target drone. An attacker could exploit this by:

1. Establishing communication with the drone's MAVLink interface from an adjacent network position
2. Sending rapid sequences of SERIAL_CONTROL messages designed to trigger shell creation and destruction
3. Timing the messages to exploit the race window between the receiver and telemetry threads
4. Causing the telemetry sender thread to access freed memory when polling shell availability

The attack does not require any authentication or user interaction, making it particularly concerning for autonomous drone operations. See the GitHub Security Advisory for additional technical details.

Detection Methods for CVE-2026-32724

Indicators of Compromise

• Unexpected drone crashes or instability during MAVLink communication sessions
• Repeated segmentation faults or memory corruption errors in PX4 system logs
• Abnormal patterns of SERIAL_CONTROL messages (ID 126) in MAVLink traffic logs
• Telemetry connection drops coinciding with shell-related operations

Detection Strategies

• Monitor MAVLink traffic for unusual volumes or patterns of SERIAL_CONTROL messages
• Implement network intrusion detection rules to flag rapid shell creation/destruction sequences
• Deploy memory sanitizers (AddressSanitizer) in development/testing environments to detect use-after-free conditions
• Review PX4 system logs for heap corruption indicators or unexpected thread terminations

Monitoring Recommendations

• Enable verbose logging for MAVLink message processing on ground control stations
• Implement rate limiting for SERIAL_CONTROL messages at the network or application level
• Monitor drone telemetry streams for sudden disconnections or anomalous behavior patterns
• Establish baseline MAVLink traffic patterns to identify deviations that may indicate exploitation attempts

How to Mitigate CVE-2026-32724

Immediate Actions Required

• Upgrade PX4 Autopilot to version 1.17.0-rc1 or later immediately
• Restrict network access to drone MAVLink interfaces to trusted ground control stations only
• Implement MAVLink message filtering to limit SERIAL_CONTROL message rates
• Review and audit all systems connecting to drone telemetry interfaces

Patch Information

The vulnerability is fixed in PX4 Autopilot version 1.17.0-rc1. Users should upgrade to this version or any subsequent release to remediate the vulnerability. The fix addresses the race condition by implementing proper thread synchronization mechanisms for shell lifecycle management.

For detailed patch information, refer to the GitHub Security Advisory GHSA-j5w2-w79c-mqrw.

Workarounds

• Disable MAVLink shell functionality if not required for operations
• Implement network segmentation to isolate drone telemetry traffic from untrusted networks
• Use MAVLink signing to authenticate messages and prevent unauthorized command injection
• Deploy firewall rules to restrict MAVLink communication to known, trusted IP addresses

# Example: Restrict MAVLink communication to trusted ground station IP
# Add to drone's network configuration or ground station firewall
iptables -A INPUT -p udp --dport 14540 -s 192.168.1.100 -j ACCEPT
iptables -A INPUT -p udp --dport 14540 -j DROP