CVE-2024-51395: ArduPilot Copter Buffer Overflow DoS Flaw

CVE-2024-51395 Overview

CVE-2024-51395 is a stack-based buffer overflow [CWE-121] in the ArduPilot Copter firmware. The flaw affects the AP_SmartAudio component, specifically the AP_SmartAudio::loop function in AP_SmartAudio.cpp. A local attacker can trigger the overflow to cause a denial of service on the flight controller. The vulnerability impacts commit 92693e023793133e49a035daf37c14433e484778 of the ArduPilot project, an open-source autopilot platform used in unmanned aerial vehicles and other autonomous systems. Successful exploitation crashes the autopilot loop and disrupts vehicle control without requiring authentication or user interaction.

Critical Impact

A local attacker can crash the ArduPilot Copter autopilot through the SmartAudio loop, resulting in loss of flight control availability.

Affected Products

• ArduPilot Copter firmware at commit 92693e023793133e49a035daf37c14433e484778
• AP_SmartAudio library component
• AP_SmartAudio.cpp source file containing the AP_SmartAudio::loop routine

Discovery Timeline

• 2026-05-13 - CVE-2024-51395 published to NVD
• 2026-05-14 - Last updated in NVD database

Technical Details for CVE-2024-51395

Vulnerability Analysis

The vulnerability resides in the AP_SmartAudio::loop function within AP_SmartAudio.cpp. SmartAudio is a protocol used to control video transmitter settings such as channel, band, and power output on first-person view (FPV) aircraft. The ArduPilot implementation processes SmartAudio responses inside a dedicated loop that runs on the flight controller. A buffer overflow condition exists in this loop when handling input data, allowing memory beyond the allocated buffer to be written. The condition is reachable from a local context and produces a denial of service by crashing the autopilot task. Because ArduPilot Copter controls flight stabilization in real time, the crash translates directly into loss of vehicle availability.

Root Cause

The root cause is improper bounds checking in the SmartAudio message handling code [CWE-121]. The AP_SmartAudio::loop routine writes to a fixed-size stack buffer without validating that incoming data fits within the buffer boundaries. When the input exceeds the expected size, adjacent stack memory is corrupted. This corruption leads to a fault that terminates the autopilot loop. See the GitHub Issue Discussion for technical context.

Attack Vector

Exploitation requires local access to the flight controller or to the serial interface used by the SmartAudio protocol. An attacker with access to the UART line carrying SmartAudio traffic, or with the ability to influence data fed into that channel, can send crafted input that overflows the buffer. No authentication or user interaction is required. The result is loss of availability, with no direct impact on confidentiality or integrity. The vulnerability mechanism is described in prose because no verified proof-of-concept code is published. Refer to the GitHub Issue Discussion for additional details.

Detection Methods for CVE-2024-51395

Indicators of Compromise

• Unexpected autopilot resets, watchdog reboots, or task crashes logged in ArduPilot .bin flight logs near AP_SmartAudio activity.
• Anomalous data patterns on the UART channel used for SmartAudio communication with video transmitters.
• Flight controllers running firmware built from commit 92693e023793133e49a035daf37c14433e484778 without applied fixes.

Detection Strategies

• Review ArduPilot dataflash logs for INTERNAL_ERROR entries and abnormal scheduler timing in the SmartAudio task.
• Audit firmware builds and source trees for the vulnerable commit hash to identify affected airframes.
• Inspect serial traffic on the SmartAudio UART for malformed frames that exceed protocol-defined lengths.

Monitoring Recommendations

• Enable verbose logging on the SmartAudio driver during ground testing and monitor for unexpected loop exits.
• Track firmware versions across fleets using a configuration management system to flag unpatched units.
• Correlate ground control station telemetry drops with autopilot reboot events to detect availability impacts.

How to Mitigate CVE-2024-51395

Immediate Actions Required

• Identify ArduPilot Copter units running firmware built from the affected commit and ground them pending remediation.
• Apply bounds checking to the AP_SmartAudio::loop input handling or disable the SmartAudio feature in the build configuration if not required.
• Restrict physical and electrical access to the flight controller serial interfaces used by SmartAudio peripherals.

Patch Information

No formal vendor patch advisory is published in the enriched data. Track remediation progress through the GitHub Issue Discussion on the ArduPilot repository and rebuild firmware from a commit that includes input validation fixes for AP_SmartAudio.cpp.

Workarounds

• Disable the SmartAudio driver in the ArduPilot build by removing or not enabling the AP_SmartAudio feature flag if video transmitter control is not required.
• Use only trusted video transmitters and SmartAudio-capable peripherals to reduce exposure on the serial line.
• Implement physical tamper protection on UART headers exposed on the flight controller board.

# Configuration example: disable SmartAudio in ArduPilot build
# Edit the hwdef.dat for your board and remove or comment the SmartAudio UART mapping,
# then rebuild the firmware:
./waf configure --board <YourBoard>
./waf copter