CyberSecBulletin

ArduPilot vulnerabilities

We track 2 vulnerabilities in ArduPilot products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on July 2, 2026.

2vulnerabilities
2critical
0high
0exploited
9.4average CVSS score

Latest ArduPilot vulnerabilities

  • 9.1 Critical severity

    Arduplane: Out-of-bounds Read

    CVE-2026-38971ArduPilot

    ardupilot through Plane-4.6.3 was found to contain an out-of-bounds read issue in libraries/GCS_MAVLink/GCS_serial_control.cpp in GCS_MAVLINK::handle_serial_control().

  • 9.8 Critical severity

    APWeb: Out-of-bounds Write

    CVE-2022-28711ArduPilotEPSS 1.71%

    A memory corruption vulnerability exists in the cgi.c unescape functionality of ArduPilot APWeb master branch 50b6b7ac - master branch 46177cb9. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger t