CVE-2025-9020 PX4 PX4-Autopilot Mavlink Shell Closing mavlink_receiver.cpp handle_message_serial_control use after free
A local attacker with high complexity can exploit a use-after-free in the Mavlink Shell Closing Handler to potentially execute code or cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-9020?
CVE-2025-9020 is a low-severity use after free vulnerability in PX4-Autopilot, published on 15 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was found in PX4 PX4-Autopilot up to 1.15.4. This issue affects the function MavlinkReceiver::handle_message_serial_control of the file src/modules/mavlink/mavlink_receiver.cpp of the component Mavlink Shell Closing Handler. The manipulation of the argument _mavlink_shell leads to use after free. An attack has to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The identifier of the patch is 4395d4f00c49b888f030f5b43e2a779f1fa78708. It is recommended to apply a patch to fix this issue.
Which versions are affected by CVE-2025-9020?
How do I fix CVE-2025-9020?
No fix has been published for CVE-2025-9020 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-9020 being exploited?
There is no known exploitation of CVE-2025-9020 in the wild and no public exploit code.
Sources
Also known as GHSA-979m-m2hv-h8pf.