CVE-2026-38971

critical · 9.1

ardupilot through Plane-4.6.3 was found to contain an out-of-bounds read issue in libraries/GCS_MAVLink/GCS_serial_control.cpp in GCS_MAVLINK::handle_serial_control().

9.1

CVSS

0.7%

EPSS (exploit prob.)

51st

EPSS percentile

2026-07-02

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weaknesses

CWE-125

Affected products

Vendor	Product	Affected versions
ardupilot	arduplane	<= 4.6.3

Check a specific version with /api/v1/cve/match.

References

https://gist.github.com/quart27219/6bfcc615f89fb493d02aad480704593b
https://github.com/ArduPilot/ardupilot
https://github.com/ArduPilot/ardupilot/issues/32524
https://github.com/ArduPilot/ardupilot/pull/32587
https://github.com/ArduPilot/ardupilot/issues/32524

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-38971