CVE-2026-38971 ArduPilot ArduPlane Vulnerability
ardupilot through Plane-4.6.3 was found to contain an out-of-bounds read issue in libraries/GCS_MAVLink/GCS_serial_control.cpp in GCS_MAVLINK::handle_serial_control().
Quick answer
ardupilot ArduPlane should be reviewed and updated if it matches the affected versions. The recommended fix is to apply the vendor-supported patched version or the mitigation steps below, then retest the public website with Fixnx.
Who is affected
Affected versions
- ArduPilot ArduPlane through Plane-4.6.3
Fixed versions
- ArduPilot Plane build containing PR #32587 or later
How to fix it
CVE-2026-38971 affects ardupilot ArduPlane. The affected range is ArduPilot ArduPlane through Plane-4.6.3. Update to ArduPilot Plane build containing PR #32587 or later. Fix exposed systems first, especially where vehicle, controller, and telemetry interfaces can be reached. If abuse is suspected, review logs and rotate secrets that may have been exposed.
- Inventory every ardupilot ArduPlane install and note the exact version.
- Compare each install with the affected range: ArduPilot ArduPlane through Plane-4.6.3.
- Update to ArduPilot Plane build containing PR #32587 or later.
- If you cannot patch today, restrict vehicle, controller, and telemetry interfaces to trusted users and networks.
- Back up the current configuration before changing production systems.
- Review recent logs for crashes, strange admin actions, failed logins, or unexpected access.
- Rotate passwords, tokens, certificates, or keys if compromise is suspected.
- Document the change, owner, date, and final version.
Scan now. Google sign-in is only needed to unlock fix guidance.
Verify the fix
- Confirm the installed version now matches the fixed guidance: ArduPilot Plane build containing PR #32587 or later.
- Confirm old affected versions are no longer deployed: ArduPilot ArduPlane through Plane-4.6.3.
- Confirm vehicle, controller, and telemetry interfaces is limited to the smallest needed group.
- Rerun the relevant Fixnx scan or internal security check after the change.
- Save logs, screenshots, or package output as proof of the fix.
Related categories
Trusted references
FAQ
What is affected by CVE-2026-38971?
ardupilot ArduPlane versions listed as affected should be reviewed: ArduPilot ArduPlane through Plane-4.6.3.
What should I fix first?
Start with internet-facing sites, admin panels, login flows, plugins, themes, modules, packages, and systems that process user-controlled input or sensitive data.
How do I confirm the fix worked?
Apply the patched version or mitigation, clear caches where relevant, retest the affected workflow, and run a new Fixnx scan to verify public website exposure signals.
How are Fixnx security risk categories chosen?
Fixnx keeps one canonical risk page and assigns only broad, relevant categories such as ecosystem, technology area, or vulnerability class.