Medium severity · published Aug 15, 2025
CVE-2025-9020
PX4 PX4-Autopilot Mavlink Shell Closing mavlink_receiver.cpp handle_message_serial_control use after free
4.5
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability was found in PX4 PX4-Autopilot up to 1.15.4. This issue affects the function MavlinkReceiver::handle_message_serial_control of the file src/modules/mavlink/mavlink_receiver.cpp of the component Mavlink Shell Closing Handler. The manipulation of the argument _mavlink_shell leads to use after free. An attack has to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The identifier of the patch is 4395d4f00c49b888f030f5b43e2a779f1fa78708. It is recommended to apply a patch to fix this issue.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PX
PX4-Autopilot · PX4
1.15.0; 1.15.1; 1.15.2; 1.15.3; 1.15.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-9020
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-9020
github.com
https://github.com/PX4/PX4-Autopilot/issues/25046
github.com
https://github.com/PX4/PX4-Autopilot/pull/25082
github.com
https://github.com/PX4/PX4-Autopilot/pull/25082/commits/4395d4f00c49b888f030f5b43e2a779f1fa78708
vuldb.com
https://vuldb.com/?ctiid.320081
vuldb.com
https://vuldb.com/?id.320081
vuldb.com
https://vuldb.com/?submit.624722
More from PX4-Autopilot
8.1
CVE-2026-32706
PX4 autopilot has a global buffer overflow in crsf_rc via oversized variable-length known packet
8.0
CVE-2026-32708
Zenoh uORB Subscriber Allows Arbitrary Stack Allocation (PX4/PX4-Autopilot)
7.8
CVE-2025-15150
PX4 PX4-Autopilot mavlink_log_handler.cpp log_entry_from_id stack-based overflow
7.1
CVE-2026-86713
PX4 Autopilot through 1.17.0 Use-After-Free in load_mon
6.8
CVE-2026-32709
PX4 Autopilot MAVLink FTP Unauthenticated Path Traversal (Arbitrary File Read/Write/Delete)