Executive brief
A vulnerability exists in the ArduPilot Copter firmware, which is used to control unmanned multirotor vehicles and helicopters. A flaw in how the software manages internal memory during communication tasks can cause the system to crash or stop responding. This could lead to a loss of control over the drone during flight, potentially resulting in a crash or mission failure.
Technical details
A stack-based buffer overflow exists in the AP_MSP::loop function within the AP_MSP.cpp component of ArduPilot Copter. The vulnerability stems from an insufficient stack size allocation (1024 bytes) for the MSP thread. Under specific build configurations and deep call stacks—specifically involving telemetry backends and MAVLink message signing—the stack usage can exceed 1096 bytes. A local attacker or specific system states can trigger this overflow, leading to memory corruption and a subsequent denial of service (firmware crash). The issue was identified in commit 92693e0.
Affected products
- ArduPilot Copter Latest commit 92693e023793133e49a035daf37c14433e484778
Timeline
- 2024-10-23: disclosed: Issue reported on GitHub repository
- 2026-05-13: advisory: NVD publication date