CVE-2026-26742 Details
Description
PX4 Autopilot versions 1.12.x through 1.15.x contain a protection mechanism failure in the "Re-arm Grace Period" logic. The system incorrectly applies the in-air emergency re-arm logic to ground scenarios. If a pilot switches to Manual mode and re-arms within 5 seconds (default configuration) of an automatic landing, the system bypasses all pre-flight safety checks, including the throttle threshold check. This allows for an immediate high-thrust takeoff if the throttle stick is raised, leading to loss of control.
A vulnerability exists in PX4 Autopilot versions 1.12.x through 1.15.x, where the "Re-arm Grace Period" logic improperly applies in-air emergency re-arm procedures to ground situations. This flaw allows a drone to bypass critical pre-flight safety checks, including the throttle threshold, leading to uncommanded high-thrust takeoffs. The issue arises when a pilot switches to Manual mode and re-arms within 5 seconds of an automatic landing, creating a risk of loss of control.
To address this vulnerability, a pre-transition safety check should be implemented. The system must verify if the vehicle is armed and if the throttle is below a certain threshold before allowing a mode switch to Manual. Until this fix is applied, operators should manually disarm the drone and ensure the throttle is at its lowest position before changing flight modes.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/npuwyw/PX4-Autopilot/blob/audit-v1.12.3-mode-transition-logic-flaw/PX4_Autopilot_Mode_Switching_Logic_Vulnerability.md | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| dronecode px4 drone autopilot | >= 1.12.0, < 1.16.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 12, 2026 | Initial Analysis | [email protected] |
| Mar 11, 2026 | CVE Modified | CISA-ADP |
| Mar 10, 2026 | New CVE Received | [email protected] |