Skip to main content
Disclosures

ArduPilot · ArduPilot / AP_ADSB

Out-of-Bounds Write in uAvionix GDL90 Message Parsing

SecMateSECMATE-2026-0016
VendorArduPilot
ProductArduPilot / AP_ADSB
AdvisoryPR #32654
Timeline
Reported
Jan 20, 2026
Acknowledged
Jan 20, 2026
Fixed
Apr 15, 2026
Published
Apr 15, 2026
Summary

ArduPilot's uAvionix GDL90 ADS-B backend could write beyond its internal message buffer while processing malformed or corrupted serial input, potentially crashing the flight stack or corrupting state. The affected parser is connected to a dedicated ADS-B sensor serial link, and no remote radio-to-parser attack path was established.

What's hidden in yours?

Find out