# CVE-2026-71644: Robotics-STAR-Lab RACER unsafe trajectory planning in FSM

Source: https://junglewise.ai/threats/cve-2026-71644-robotics-star-lab-racer-unsafe-trajectory-planning-in-fsm  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-11. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-71644 · Severity: critical · CVSS 9.8 · Published 2026-09-11

RACER is a multi-UAV collaborative exploration system for autonomous drones. A missing state handler in the trajectory-publishing logic causes idle drones to stop broadcasting their position to the swarm, leading other drones to plan paths based on incomplete or stale information. This can result in collisions between UAVs or unsafe flight behavior in coordinated multi-drone operations.

## Quick answers

**Is CVE-2026-71644 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71644 being exploited in the wild.

**How severe is CVE-2026-71644?** Critical severity, with a CVSS score of 9.8, published 11 September 2026.

**Which products and versions are affected?** Robotics-STAR-Lab RACER commit abcdef1234567890 and potentially earlier versions.

**Is there a fix for CVE-2026-71644?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-71644 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-71644?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing default case in the FastExplorationFSM::swarmTrajTimerCallback() function. The callback publishes trajectory data when the UAV is in EXEC_TRAJ (moving) and WAIT_TRIGGER (stationary virtual trajectory) states, but does not publish anything when the FSM enters the IDLE state. As a result, other UAVs in the swarm receive only stale or outdated trajectory information for idle drones, causing them to perform collision-checking and trajectory planning without accurate awareness of the idle drone's actual physical position. The root cause is incomplete FSM state handling. An attacker with the ability to trigger UAVs into the IDLE state (or a UAV legitimately transitioning to idle) can exploit this. The fix requires adding an IDLE case to publish a stationary trajectory at the drone's current position, consistent with the WAIT_TRIGGER behavior.

## Affected products

- Robotics-STAR-Lab RACER commit abcdef1234567890 and potentially earlier versions

## Timeline

- 2026-09-11: disclosed: CVE-2026-71644 published

## References

- [https://gist.github.com/DongJiaxin0422/6c39c3c59236bc2c8ec4b4182284fa7e](https://gist.github.com/DongJiaxin0422/6c39c3c59236bc2c8ec4b4182284fa7e)
- [https://github.com/Robotics-STAR-Lab/RACER](https://github.com/Robotics-STAR-Lab/RACER)