Skip to main content
Disclosures

ArduPilot · ArduPilot / AP_ADSB

Out-of-Bounds Write in Sagetech MXS Message Parsing

SecMateSECMATE-2026-0014
VendorArduPilot
ProductArduPilot / AP_ADSB
AdvisoryPR #32656
Timeline
Reported
Jan 20, 2026
Acknowledged
Jan 20, 2026
Fixed
Apr 15, 2026
Published
Apr 15, 2026
Summary

ArduPilot's Sagetech MXS ADS-B backend did not safely handle certain receiver messages, allowing malformed or corrupted serial input to write outside the intended message buffer. This could crash the flight stack or corrupt state. The affected parser is connected to a dedicated ADS-B sensor serial link, and no remote radio-to-parser attack path was established.

What's hidden in yours?

Find out