ArduPilot Copter contains a stack‑based buffer overflow in the AP_MSP::loop component of AP_MSP.cpp. An attacker who can execute code locally on a copter device may overflow a buffer during an MSP loop, leading to a crash of the Copter’s software and thereby denying service. The weakness is a classic buffer overflow (CWE-119).

The vulnerability is present in ArduPilot Copter software, specifically affecting the AP_MSP::loop, AP_MSP, and AP_MSP.cpp modules. No particular product version is cited, but any instance of the Copter code base that has not been updated to the latest commit 92693e023793133e49a035daf37c14433e484778 is likely impacted.

The attack vector is local; an adversary must already have access to the copter’s operating environment to trigger the overflow. The CVSS score is 5.5, and EPSS data is unavailable, giving a moderate indication of exploit likelihood. The vulnerability is not listed in the CISA KEV catalog, indicating no known exploitation in the wild. Nevertheless, a local attacker can cause a denial of service by crashing the Copter’s software, potentially interrupting flight operations.