Read the docs
TI-2025-08266 Aliases CVE-2025-9020GHSA-979m-m2hv-h8pf

PX4 PX4-Autopilot Mavlink Shell Closing mavlink_receiver.cpp handle_message_serial_control use after free

Priority LOW 10CWE-119Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A vulnerability was found in PX4 PX4-Autopilot up to 1.15.4. This issue affects the function MavlinkReceiver::handle_message_serial_control of the file src/modules/mavlink/mavlink_receiver.cpp of the component Mavlink Shell Closing Handler. The manipulation of the argument _mavlink_shell leads to use after free. An attack has to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The identifier of the patch is 4395d4f00c49b888f030f5b43e2a779f1fa78708. It is recommended to apply a patch to fix this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00171 6th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PX4PX4-Autopilot1.15.0; 1.15.1; 1.15.2; 1.15.3; 1.15.4—No fix listedCNA
  • PX4-Autopilot VendorPX4 Affected 1.15.0; 1.15.1; 1.15.2; 1.15.3; 1.15.4 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:dronecode:px4_drone_autopilot:*:*:*:*:*:*:*:*——Dronecode
  • cpe:2.3:a:dronecode:px4_drone_autopilot:*:*:*:*:*:*:*:* Versions — — ·Dronecode

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-9020
  2. 2026-10-03 Alias added: GHSA-979m-m2hv-h8pf

References

Patch 1

Other 2

  • TI-2023-24883 PX4-Autopilot Heap Buffer Overflow Bug CVSS 3.1CRITICAL 9.8
  • TI-2026-25200 Zenoh uORB Subscriber Allows Arbitrary Stack Allocation (PX4/PX4-Autopilot) CVSS 3.1HIGH 8.0
  • TI-2026-25198 PX4 autopilot has a global buffer overflow in crsf_rc via oversized variable-length known packet CVSS 3.1HIGH 8.1
  • TI-2026-25197 PX4 autopilot BST Device Name Length Can Overflow Driver Buffer CVSS 3.1MEDIUM 6.8
  • TI-2026-65506 PX4 Autopilot through 1.17.0 Stack Exhaustion via tests file2 Command CVSS 4.0HIGH 7.1
  • TI-2026-59272 PX4 Autopilot through 1.17.0 Use-After-Free in load_mon CVSS 4.0HIGH 7.1
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences