CVE-2026-71640 Details

A vulnerability exists in ZJU-FAST-Lab EGO-Planner-v2 in all versions prior to commit 5c99a95880401e2599638d567abc0e240396cb42. The issue arises in the replanning pipeline, where expired trajectory data is improperly managed, allowing for unsafe vehicle movements. The function 'EGOReplanFSM::planFromLocalTraj()' can use outdated local trajectory information to initiate replanning, which may not reflect the actual state of the UAV or the state being controlled. This mismanagement can result in unstable recovery behaviors and the creation of hazardous flight paths.

To address this vulnerability, the trajectory evaluation time should be validated and clamped before querying the local trajectory. Alternatively, the same expiration handling as the controller can be applied, ensuring that replanning starts from a physically accurate state.