CVE-2026-38971
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
An out-of-bounds read issue was found in the GCS_MAVLink library of ArduPilot up to version Plane-4.6.3, specifically in the GCS_MAVLINK::handle_serial_control() function. This vulnerability may lead to unexpected behavior or data leakage.
Risk Assessment
The risk involves potential data integrity compromise or exposure of sensitive information in systems running ArduPilot, which could affect the safety of flight operations.
Recommendation
It is recommended to immediately update ArduPilot to a version newer than Plane-4.6.3 and apply security patches provided by the vendor.
Original NVD description (English source)
ardupilot through Plane-4.6.3 was found to contain an out-of-bounds read issue in libraries/GCS_MAVLink/GCS_serial_control.cpp in GCS_MAVLINK::handle_serial_control().