CVE-2026-71644 Details

A vulnerability exists in the Robotics-STAR-Lab RACER project, specifically in commit abcdef1234567890. The issue arises within the 'FastExplorationFSM::swarmTrajTimerCallback()' function, where the state machine fails to publish a drone's trajectory when it enters the 'IDLE' state. This omission can lead to unsafe trajectory planning and potential collisions between unmanned aerial vehicles (UAVs) in the swarm. While a drone is in 'IDLE', it physically occupies space but does not broadcast its position, causing other UAVs to rely on outdated or inaccurate trajectory information. The problem stems from the absence of a default case in the finite state machine (FSM) that manages swarm trajectory publications, particularly for drones that are idle but still present in the environment.

Modify the 'swarmTrajTimerCallback()' function to include a case for the 'IDLE' state that publishes a virtual stationary trajectory at the drone's current position. This can be done by adding 'IDLE' to the existing 'WAIT_TRIGGER' case, ensuring that idle drones are accurately represented in the swarm's trajectory coordination.