Executive brief
RACER is a multi-UAV collaborative exploration system for autonomous drones. A missing state handler in the trajectory-publishing logic causes idle drones to stop broadcasting their position to the swarm, leading other drones to plan paths based on incomplete or stale information. This can result in collisions between UAVs or unsafe flight behavior in coordinated multi-drone operations.
Technical details
The vulnerability is a missing default case in the FastExplorationFSM::swarmTrajTimerCallback() function. The callback publishes trajectory data when the UAV is in EXEC_TRAJ (moving) and WAIT_TRIGGER (stationary virtual trajectory) states, but does not publish anything when the FSM enters the IDLE state. As a result, other UAVs in the swarm receive only stale or outdated trajectory information for idle drones, causing them to perform collision-checking and trajectory planning without accurate awareness of the idle drone's actual physical position. The root cause is incomplete FSM state handling. An attacker with the ability to trigger UAVs into the IDLE state (or a UAV legitimately transitioning to idle) can exploit this. The fix requires adding an IDLE case to publish a stationary trajectory at the drone's current position, consistent with the WAIT_TRIGGER behavior.
Affected products
- Robotics-STAR-Lab RACER commit abcdef1234567890 and potentially earlier versions
Timeline
- 2026-09-11: disclosed: CVE-2026-71644 published