Critical severity9.1NVD Advisory· Published Jul 2, 2026· Updated Jul 9, 2026

CVE-2026-38971

Description

ardupilot through Plane-4.6.3 was found to contain an out-of-bounds read issue in libraries/GCS_MAVLink/GCS_serial_control.cpp in GCS_MAVLINK::handle_serial_control().

Affected products

ArduPilot/Arduplane
cpe:2.3:a:ardupilot:arduplane:*:*:*:*:*:*:*:*
Range: <=4.6.3
ArduPilot/Ardupilotllm-fuzzy
Range: <=Plane-4.6.3

Patches

Vulnerability mechanics

References

github.com/ArduPilot/ardupilot/pull/32587nvdIssue TrackingPatch
github.com/ArduPilot/ardupilot/issues/32524nvdExploitIssue Tracking
gist.github.com/quart27219/6bfcc615f89fb493d02aad480704593bnvd

News mentions

No linked articles in our index yet.

cvss	0.591
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000