CVE-2026-71644
Received Received - Intake

Unsafe Trajectory Planning in RACER via Missing FSM Default Case

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: MITRE

Description
An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause unsafe trajectory planning and potential UAV collisions via a missing default case in the FSM that stops publishing swarm trajectories when the drone enters IDLE

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-71644
EUVD
EUVD-2026-76112

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
sysu_star_group racer *
sysu_star_group racer From abcdef1234567890 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-843 The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-71644 is a flaw in the RACER software's trajectory planning system for UAVs. When a drone enters the IDLE state, it stops publishing its trajectory to other drones in the swarm. This happens because the swarmTrajTimerCallback() function lacks a default case to handle the IDLE state, causing other drones to lose awareness of the idle drone's position. This can lead to unsafe trajectory planning and potential collisions.

Detection Guidance

To detect this vulnerability, inspect the RACER software's trajectory planning system for missing trajectory publication in the IDLE state. Check the FastExplorationFSM::swarmTrajTimerCallback() function in the source code for absence of logic handling the IDLE state. Monitor UAV swarm communication logs for drones that stop broadcasting trajectories upon entering IDLE.

Impact Analysis

This vulnerability can cause unsafe trajectory planning for UAVs, increasing the risk of collisions or unsafe proximity between drones. If a drone enters IDLE and stops broadcasting its trajectory, other drones may rely on outdated information, leading to incorrect collision avoidance and potential accidents.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it pertains to UAV trajectory planning and collision risks rather than data privacy or healthcare operations. However, unsafe UAV operations could indirectly impact regulatory compliance in industries where UAVs are used for inspections or deliveries, potentially violating safety or operational standards.

Mitigation Strategies

Modify the swarmTrajTimerCallback() function to include a branch for the IDLE state that publishes a virtual stationary trajectory at the drone's current position. Alternatively, refactor the code to share trajectory generation logic between non-executing states (IDLE, WAIT_TRIGGER) to ensure continuous trajectory broadcasting.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71644. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart