CVE-2026-38971

Critical · CVSS 9.1

ardupilot — out-of-bounds read (CWE-125)

CVSS: 9.1; nvd
EPSS: —
KEV: No
Class: oss containerizable; CWE-125

Description

ardupilot through Plane-4.6.3 was found to contain an out-of-bounds read issue in libraries/GCS_MAVLink/GCS_serial_control.cpp in GCS_MAVLINK::handle_serial_control().

Search profile — drives PoC discovery

Symbols GCS_MAVLINK::handle_serial_controlGCS_serial_control.cpplibraries/GCS_MAVLink/GCS_serial_control.cpphandle_serial_controlSERIAL_CONTROL

Keywords CVE-2026-38971ardupilotout-of-bounds readGCS_MAVLinkhandle_serial_controlGCS_serial_controlPlane-4.6.3SERIAL_CONTROL MAVLinkardupilot OOB readardupilot CWE-125

Versions: through Plane-4.6.3

Ranked PoCs (1) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

ArduPilot/ardupilot valid MVP

containerized · known researcher · cited in references

trickest

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-07-09T00:00:39.000Z · profiled 2026-07-09T00:30:39.000Z