An out‑of‑bounds read was identified in GCS_serial_control.cpp within the handle_serial_control function of the GCS_MAVLink module for ArduPilot Plane firmware versions up to 4.6.3. The flaw allows a reader to access memory beyond the intended buffer boundaries, potentially exposing internal data such as configuration, telemetry, or other state information. The description does not specify exactly what data may be leaked, but based on common contents of the GCS MavLink buffer it is inferred that sensitive information could be disclosed. The vulnerability does not provide a path to code execution, denial of service, or other active attacks.

Planes running ArduPilot firmware 4.6.3 or earlier that have the GCS_MAVLink module enabled and accept serial control commands are impacted. Any deployment that uses the GCS serial control interface, regardless of build variant or distribution channel, can potentially be affected.

The CVSS score of 9.1 places this flaw in the critical severity range, while an EPSS score of less than 1% and its absence from the CISA KEV list suggest a low likelihood of active exploitation. Based on the description, the likely attack vector requires the ability to send crafted serial control messages to the GCS_MAVLink module, which could be achieved either locally or remotely if the serial interface is exposed. Successful exploitation would result in reading unintended memory contents, leading to a breach of confidentiality, but there is no evidence that it could trigger code execution or a service disruption.