An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890

Published September 11, 2026 CVE-2026-71644

RACER can stop sharing an idle drone's position with nearby drones. They may plan unsafe routes and potentially collide.

Severity
CriticalCVSS 3.1 · 9.8 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
Fix
Not confirmedLast checked today
Weakness
CWE-843
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: yes · Technical impact: total
EU ID
EUVD-2026-76112ENISA vulnerability database

How it works

  • The supplied evidence does not explain how an attacker makes a drone enter IDLE.
  • When a RACER drone enters IDLE, its position-sharing process matches no publication branch.
  • The stationary drone then stops broadcasting its occupied position.
  • Other drones may retain stale information or eventually lose its valid position.
  • Their route planning may omit the idle drone, creating unsafe proximity and potential collisions.

What to do

If your drone project uses RACER, check whether its deployed source revision is commit abcdef1234567890. Treat a match as the tested affected revision; the evidence does not establish a broader affected range.

Review RACER issue 50 and evaluate the reporter's suggested change for IDLE position sharing. Confirm with the RACER maintainer that the change is accepted before treating it as a fix. Verify the deployed code keeps sharing an idle drone's stationary position before operating the fleet.

Technical details

RACER's FastExplorationFSM::swarmTrajTimerCallback publishes trajectories during EXEC_TRAJ and stationary positions during WAIT_TRIGGER, but has no equivalent branch for IDLE. Receiving drones may use stale data or stop accounting for the idle drone, depending on how they cache and expire received trajectories. The tested affected revision is commit abcdef1234567890. The issue reporter suggests handling IDLE alongside WAIT_TRIGGER, but the supplied evidence does not confirm an accepted fix or fixed release.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source