Timeline
Reported
Jan 20, 2026
Acknowledged
Jan 20, 2026
Fixed
Apr 15, 2026
Published
Apr 15, 2026
Summary
ArduPilot's uAvionix GDL90 ADS-B backend could write beyond its internal message buffer while processing malformed or corrupted serial input, potentially crashing the flight stack or corrupting state. The affected parser is connected to a dedicated ADS-B sensor serial link, and no remote radio-to-parser attack path was established.