CVE-2026-86097: PX4 Autopilot DOS Vulnerability

CVE-2026-86097 Overview

CVE-2026-86097 is a null pointer dereference vulnerability [CWE-476] in PX4 Autopilot through version 1.17.0. The flaw resides in the param_set_default_file() and param_set_backup_file() functions within the parameter subsystem. Attackers can invoke the param select or param select-backup commands without a path argument from any PX4 shell to crash the autopilot process. PX4 Autopilot is widely deployed as flight control software for unmanned aerial vehicles (UAVs), drones, and other autonomous vehicles.

Critical Impact
An attacker with adjacent network access to a PX4 shell can crash the autopilot process mid-flight, potentially causing loss of vehicle control and physical damage.

Affected Products

PX4 Autopilot versions through 1.17.0
Deployments exposing MAVLink or NuttX shell interfaces
UAV and drone platforms using PX4 flight control software

Discovery Timeline

2026-09-04 - CVE-2026-86097 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-86097

Vulnerability Analysis

The vulnerability exists in src/lib/parameters/parameters.cpp. The functions param_set_default_file() and param_set_backup_file() accept a filename argument and pass it to strcmp() without validating that the pointer is non-null. When a user invokes param select or param select-backup from a PX4 shell without supplying a path, the filename parameter is null. The subsequent call to strcmp(filename, param_backup_file) dereferences the null pointer and crashes the autopilot process.

Because PX4 controls flight operations, a crash of the autopilot process can result in loss of control authority over an active vehicle. The impact is confined to availability, with no data confidentiality or integrity consequences.

Root Cause

The root cause is missing input validation on the filename argument before it is passed to strcmp(). C-style string comparison functions require non-null pointers, and PX4 did not enforce this precondition when handling shell-supplied arguments.

Attack Vector

Exploitation requires access to a PX4 shell, which is typically reachable over an adjacent network channel such as MAVLink, serial, or a USB console. No authentication or user interaction is required beyond shell access. An attacker issues either param select or param select-backup with no path argument to trigger the crash.

cpp

// Security patch in src/lib/parameters/parameters.cpp
 int
 param_set_default_file(const char *filename)
 {
-	if ((param_backup_file && strcmp(filename, param_backup_file) == 0)) {
+	if (filename && param_backup_file && strcmp(filename, param_backup_file) == 0) {
 		PX4_ERR("default file can't be the same as the backup file %s", filename);
 		return PX4_ERROR;
 	}

Source: PX4 Autopilot Commit 02eabc0. The patch adds a null check on filename before invoking strcmp().

Detection Methods for CVE-2026-86097

Indicators of Compromise

Unexpected termination or restart of the PX4 autopilot process on a UAV platform
Log entries showing param select or param select-backup commands issued without a path argument
MAVLink command traffic invoking parameter subsystem commands from unauthorized ground control stations

Detection Strategies

Inspect PX4 shell command history and MAVLink SHELL_COMMAND messages for calls to param select or param select-backup without arguments
Monitor autopilot uptime and process restart counters for anomalies during flight or on the ground
Correlate segmentation fault logs from NuttX or the host OS with parameter subsystem activity

Monitoring Recommendations

Ingest MAVLink telemetry and PX4 system logs into a centralized logging pipeline for behavioral analysis
Alert on any unauthenticated shell command traffic reaching PX4 vehicles over adjacent networks
Track deployed PX4 firmware versions across the UAV fleet to identify unpatched systems

How to Mitigate CVE-2026-86097

Immediate Actions Required

Upgrade PX4 Autopilot to a version that includes commit 02eabc0 from PR #28475
Restrict access to MAVLink and serial shell interfaces to authenticated operators and trusted ground control stations
Disable PX4 shell command access on production flight platforms where it is not operationally required

Patch Information

The fix is available in the PX4 Autopilot repository via commit 02eabc08c9b8cb1de525070cacb7ea0c495136f6, merged through pull request #28475. Refer to the VulnCheck Advisory for PX4 for additional context.

Workarounds

Block or filter MAVLink SHELL_COMMAND messages at the ground control station or radio link layer
Segment UAV command-and-control networks to prevent adjacent-network attackers from reaching PX4 shells
Enforce operator procedures requiring a path argument whenever using param select or param select-backup

bash

# Verify the deployed PX4 Autopilot version and apply the patched build
git clone https://github.com/PX4/PX4-Autopilot.git
cd PX4-Autopilot
git log --oneline | grep 02eabc0
# Rebuild firmware from a branch containing the fix
make px4_fmu-v5_default