What’s Vulnerable › Vulnerabilities

CVE-2026-38971

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-07-02 · updated 2026-07-09
• Weakness: CWE-125

Description

ardupilot through Plane-4.6.3 was found to contain an out-of-bounds read issue in libraries/GCS_MAVLink/GCS_serial_control.cpp in GCS_MAVLINK::handle_serial_control().

Affected products

• ArduPilot Arduplane: through 4.6.3

References

• https://gist.github.com/quart27219/6bfcc615f89fb493d02aad480704593b
• https://github.com/ArduPilot/ardupilot
• https://github.com/ArduPilot/ardupilot/issues/32524
• https://github.com/ArduPilot/ardupilot/pull/32587
• https://github.com/ArduPilot/ardupilot/issues/32524

Get alerted when CVE-2026-38971 or the next vulnerability affects your stack