{"uuid": "e4a9fb17-db04-40e8-9e50-6319acae6878", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71644", "type": "seen", "source": "https://gist.github.com/DongJiaxin0422/6c39c3c59236bc2c8ec4b4182284fa7e", "content": "# CVE-2026-71644\n\n[CVE ID]\n\nCVE-2026-71644\n\n\n[PRODUCT]\n\nRACER\n\n\n[VERSION]\n\nRACER commit abcdef1234567890.\n\n\n[PROBLEM TYPE]\n\nUnsafe trajectory planning and potential UAV collision caused by missing swarm-trajectory publication in the IDLE state.\n\n\n[DESCRIPTION]\n\nRACER contains an issue in `FastExplorationFSM::swarmTrajTimerCallback()` where a UAV stops publishing its swarm trajectory after entering the `IDLE` state.\n\nThe callback publishes `fd_->newest_traj_` while the UAV is in `EXEC_TRAJ` and publishes a virtual stationary trajectory at the current position while the UAV is in `WAIT_TRIGGER`. However, there is no corresponding trajectory-publication branch for `IDLE`.\n\nAs a result, a UAV that remains physically stationary in the environment after entering `IDLE` no longer continuously broadcasts a trajectory representing its occupied position. Other UAVs may therefore receive only stale trajectory information or eventually have no valid up-to-date trajectory representation for the idle UAV.\n\nThis can cause other UAVs to perform trajectory planning or collision checking without an accurate representation of the idle UAV's current occupied position.\n\n\n[IMPACT]\n\nOther UAVs may plan trajectories based on incomplete or stale swarm-state information and fail to correctly account for an idle UAV that is still physically present in the shared environment.\n\nThis can result in unsafe trajectory planning, unsafe inter-UAV proximity, and potential UAV collisions. The exact manifestation depends on how receiving UAVs cache and expire previously received swarm trajectories.\n\n\n[ROOT CAUSE]\n\n`FastExplorationFSM::swarmTrajTimerCallback()` does not handle the `IDLE` state when publishing swarm trajectories.\n\nThe callback explicitly publishes a moving trajectory in `EXEC_TRAJ` and a virtual stationary trajectory in `WAIT_TRIGGER`, but neither publishes the existing trajectory nor constructs a stationary trajectory when the FSM is in `IDLE`.\n\nTherefore, once a UAV enters `IDLE`, its physical occupancy is no longer continuously represented through the swarm trajectory communication mechanism.\n\nThis is inconsistent with the existing `WAIT_TRIGGER` behavior, which explicitly publishes a stationary virtual trajectory at the current UAV position to avoid collisions.", "creation_timestamp": "2026-09-08T08:18:15.166651Z"}