Tianbo Wang

PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the load mon module's stop path where exit and cleanup() deletes the LoadMon object and frees the performance counter before perf end() attempts to access it. Attackers can trigger this vulnerability by issuing the load mon stop command from any PXH or MAVLink shell, causing reads and writes through freed memory that corrupt heap objects and destabilize the flight stack.

PX4 Autopilot through 1.17.0 contains a stack buffer over-read vulnerability in the netman system command that fails to validate interface name length. Attackers can supply interface names of 74 bytes or more via the -i option to read beyond buffer boundaries, leaking stack memory to console output or writing it into persistent network configuration files.