CVE-2026-71644: RACER UAV Trajectory Planning Vulnerability

CVE-2026-71644 Overview

CVE-2026-71644 affects the RACER (Rapid Exploration with Cooperative UAVs) framework developed by the Robotics-STAR-Lab (SYSU STAR Group). The vulnerability exists in commit abcdef1234567890 and stems from a missing default case in the finite state machine (FSM) that controls swarm trajectory publication. When a drone transitions into the IDLE state, the FSM stops publishing swarm trajectories, which can produce unsafe trajectory planning and unmanned aerial vehicle (UAV) collisions across the swarm. The flaw is classified under [CWE-843: Access of Resource Using Incompatible Type (Type Confusion)] and impacts safety-critical multi-robot coordination workloads that rely on RACER's shared trajectory bus.

Critical Impact
A missing FSM default branch allows an attacker or fault condition to halt swarm trajectory publishing, causing coordinated UAVs to plan without peer awareness and potentially collide mid-flight.

Affected Products

Robotics-STAR-Lab RACER framework at commit abcdef1234567890
SYSU STAR Group RACER swarm exploration stack
Downstream UAV deployments integrating RACER's swarm trajectory publisher

Discovery Timeline

2026-09-11 - CVE-2026-71644 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-71644

Vulnerability Analysis

RACER coordinates multiple UAVs by publishing swarm trajectories from each drone's FSM node to peers on the shared communication bus. The FSM implementation lacks a default case, so when execution reaches an unhandled state, notably the IDLE state, the publishing routine is silently skipped. Peers continue to receive no updated trajectory data for the affected drone. Neighboring UAVs then plan their own paths against a stale or absent representation of the swarm, and the safety guarantees provided by cooperative planning no longer hold.

The defect is a logic and control-flow flaw rather than a memory-corruption bug. It does not corrupt process memory, yet its physical-world consequence is severe because RACER is deployed on airborne platforms. Attackers who can drive an FSM into IDLE, whether through message injection, forced state transitions, or induced fault conditions on the control plane, can effectively remove a drone from the shared trajectory view while keeping it airborne. Refer to the GitHub RACER Issue Discussion for the maintainer thread.

Root Cause

The root cause is a missing default branch in the FSM switch construct that gates swarm trajectory publication. States not explicitly enumerated, including IDLE, fall through without invoking the publish call. There is no fallback that either republishes the last known trajectory, publishes an explicit stop marker, or raises a safety fault to peers.

Attack Vector

An attacker on the network path used by the RACER communication layer can trigger the unsafe condition by inducing a transition into the unhandled state on a target drone. Because the affected node stops emitting trajectories rather than emitting a bad one, peers do not detect the drop as a fault. The result is degraded collision avoidance across the swarm without any explicit error signal. See the GitHub Gist PoC for reproduction notes.

// No verified exploit code is published with this CVE.
// The defect is a missing default branch in the swarm-trajectory FSM;
// see the linked GitHub issue and gist for reproduction details.

Detection Methods for CVE-2026-71644

Indicators of Compromise

Extended gaps in swarm trajectory topic publications from a specific drone while its telemetry indicates the platform is powered and airborne
FSM state logs showing transitions into IDLE without a corresponding trajectory publish event
Peer drones logging missing neighbor trajectories immediately before near-miss or collision events

Detection Strategies

Instrument the RACER FSM to emit a heartbeat on every state transition and alert when a publish action is expected but absent
Add unit and integration tests that iterate over all FSM states, including IDLE, and assert that the trajectory publisher is invoked or an explicit safe-stop message is sent
Compare expected publish cadence against observed cadence on the swarm trajectory topic and flag drops beyond a defined threshold

Monitoring Recommendations

Monitor ROS topic publication rates for the swarm trajectory channel per drone and alert on sudden zero-rate conditions
Correlate FSM state telemetry with trajectory publishing telemetry in a centralized log store for post-flight review
Track collision-avoidance planner warnings from peer drones as leading indicators of a stalled publisher on another node

How to Mitigate CVE-2026-71644

Immediate Actions Required

Patch the FSM switch to include a default branch that either publishes a safe-stop trajectory or raises an explicit fault to peers
Restrict network access to the RACER communication layer so untrusted hosts cannot induce state transitions on airborne UAVs
Ground fleets running the affected commit until the FSM logic is fixed and validated in simulation

Patch Information

No vendor patch is referenced in the NVD entry at publication. Operators should track the upstream GitHub RACER Project and the GitHub RACER Issue Discussion for a maintainer fix, then rebuild and redeploy the swarm binaries once the FSM update lands.

Workarounds

Add a local patch that inserts a default case in the FSM to publish a hover or land command whenever the state is unhandled
Introduce a watchdog on each drone that detects missing trajectory publications and forces a controlled land
Isolate swarm test flights to physically bounded environments until the fix is verified in hardware-in-the-loop testing

bash

# Configuration example: enforce a publisher watchdog on the swarm trajectory topic
# (adjust topic name and threshold to match your RACER deployment)
rostopic hz /swarm/trajectory --window=50 \
  | awk '/average rate/ {if ($3+0 < 5.0) print "ALERT: swarm trajectory publisher stalled"}'