CVE-2026-86713 is a use-after-free vulnerability in PX4 Autopilot through version 1.17.0. The flaw exists in the load_mon module's stop path where exit_and_cleanup() deletes the LoadMon object and frees the performance counter before perf_end() attempts to access it. This leads to reads and writes through freed memory, corrupting heap objects and destabilizing the flight stack. The vulnerability can be triggered remotely by issuing the load_mon stop command from PXH or MAVLink shell without requiring privileges or user interaction.

Successful exploitation allows an attacker to cause heap corruption and destabilize the flight stack of PX4 Autopilot, potentially affecting flight stability and safety. The vulnerability can be triggered remotely without authentication or user interaction, increasing the risk of exploitation in affected environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid issuing the load_mon stop command from PXH or MAVLink shell in untrusted environments to reduce risk.