CVE-2026-71640

ZJU-FAST-Lab EGO-Planner-v2 contains an improper handling of exceptional conditions (CWE-703) in its replanning pipeline: trajectory data that has expired is not correctly checked or discarded, so the vehicle can continue executing a stale trajectory. The issue affects all versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 and is rated critical (CVSS 3.1: 9.1) with a network attack vector requiring no privileges or user interaction. If triggered — for example, by conditions that stall replanning while old trajectory segments remain valid in the pipeline — the aircraft may perform unsafe motion, risking crashes, physical damage, and loss of the platform (high availability impact per the CVSS vector). Affected users are robotics researchers, students, and developers building UAVs on the open-source EGO-Planner-v2 planner, typically within ROS-based research and hobbyist drones. No public proof of concept exists, the CVE is not in CISA's KEV catalog, and no exploitation in the wild has been reported.

What to do: Update EGO-Planner-v2 to a revision newer than commit 5c99a95880401e2599638d567abc0e240396cb42 where trajectory expiry handling has been fixed. Independently, add a failsafe that discards any trajectory whose timestamp has expired and commands hover/land when replanning fails, and validate trajectory age before execution. Restrict network access to ROS topics, MAVLink, and other planner interfaces so untrusted peers cannot influence the replanning pipeline.