External risk intelligence

ArduPilot Out-of-Bounds Read Vulnerability in GCS Serial Control

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-38971

ArduPilot is specialized autopilot software for unmanned vehicles. While it utilizes network protocols like MAVLink, these are typically operated within private control links, telemetry radios, or isolated ground control station networks rather than exposed directly to the public internet in common deployment patterns.

Out-of-bounds Read

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An out-of-bounds read vulnerability exists in ArduPilot autopilot software, specifically within the MAVLink communication protocol handling. This issue could potentially allow for unintended access to memory, impacting the integrity of operations. The primary concern is to confirm if this software is deployed within our environment and assess any potential exposure.

Software handling autopilot communications has a memory access flaw.
Critical for assessing potential impact on our operations.
Confirm relevance and exposure for this autopilot software.

Attack Path

How an attacker could exploit the issue

An attacker could target the ArduPilot system by sending specially crafted MAVLink messages. This could be done over a network connection that reaches the affected component, specifically the `GCS_MAVLINK::handle_serial_control()` function. If successful, this could lead to an out-of-bounds read, potentially compromising the system's integrity and availability.

Network access required.
Triggered by malformed serial control messages.
Risk of system instability and information disclosure.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect the behavior of the GCS_MAVLink component when handling specific serial control messages. When supported by the advisory and conditions, an out-of-bounds read could occur, potentially impacting the stability of the Ground Control Station software. The advisory does not indicate that system data, user data, or PII are at risk.

System stability of GCS software.
Malicious serial control message received.
Software crash or unstable behavior.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in ArduPilot's MAVLink handling likely impacts teams responsible for unmanned vehicle operations and their associated ground control systems. The initial focus should be on identifying all instances of ArduPilot, assessing their operational criticality and network exposure, and then determining the specific ownership for remediation planning and execution, which may involve coordination with hardware or system integrators.

Own the inventory and exposure assessment.
Verify network reachability and operational impact.
Plan remediation with relevant stakeholders.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ArduPilot?

ArduPilot is an open-source autopilot software suite used to control unmanned vehicles, such as drones and rovers. It manages flight navigation, motor output, and sensor data. It relies on the MAVLink protocol to communicate between the vehicle and a Ground Control Station, which is where this specific vulnerability resides.

What does CVE-2026-38971 mean by out-of-bounds read?

This vulnerability is an out-of-bounds read, classified as CWE-125. In plain terms, the software fails to properly check the limits of memory buffers when processing incoming data. Because it reads past the intended boundary of a data structure, the system may access sensitive memory areas, potentially leading to unauthorized information disclosure or causing the application to crash.

How is this vulnerability triggered?

The flaw is triggered when the GCS_MAVLINK::handle_serial_control() function processes a malformed or specially crafted serial control message. It is important to note that sending standard, well-formed MAVLink messages during normal vehicle operation does not trigger this issue; the vulnerability requires specifically structured data designed to exploit the memory handling error.

Is my ArduPilot system at risk?

According to Halo Surface Signal, risk depends on how your network is configured. ArduPilot is typically used within private telemetry links or isolated ground stations, which reduces the chance of unauthorized network access. You should be most concerned if your Ground Control Station or autopilot hardware is reachable via the public internet rather than kept on a dedicated, private control network.

What should I do if I run ArduPilot?

First, create an inventory of all systems running ArduPilot to understand where they are deployed. Evaluate whether these systems are exposed to external networks. Once identified, coordinate with your system integrators or technical leads to plan for necessary software updates or configuration changes to secure the communication path between your vehicles and control stations.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.