Executive brief
ArduPilot, an open-source autopilot system for drones and unmanned vehicles, contains a flaw in how it handles serial communication messages. An attacker could send a specially crafted message that causes the system to read and transmit unintended data from its internal memory. This could lead to the exposure of sensitive system information or cause the device to behave unpredictably.
Technical details
An out-of-bounds read vulnerability exists in `libraries/GCS_MAVLink/GCS_serial_control.cpp` within the `GCS_MAVLINK::handle_serial_control()` function. The root cause is a failure to validate the `count` field in `MAVLINK_MSG_ID_SERIAL_CONTROL` packets against the actual size of the `packet.data` buffer (70 bytes). If a packet is received with a `count` value exceeding the buffer size, the system reads past the decoded packet on the stack and transmits uninitialized bytes or stack junk over the serial interface. This can be triggered by a remote attacker capable of sending MAVLink traffic to the device. The issue was addressed in PR #32587 by capping the transmission size to the buffer limit.
Affected products
- ArduPilot ArduPilot through Plane-4.6.3
Timeline
- 2026-03-29: patched: Fix merged in Pull Request #32587
- 2026-07-02: advisory: CVE-2026-38971 published by NVD