CVE-2026-71646

RACER, an open-source UAV swarm exploration framework from Sun Yat-sen University's STAR Group (Robotics-STAR-Lab), contains an uncontrolled resource consumption flaw (CWE-400) in the FastExplorationFSM::optTimerCallback() routine in swarm_exploration/exploration_manager/src/fast_exploration_fsm.cpp. Because the CVSS vector is network/low-complexity/no-privileges, an attacker who can reach the robot's ROS network can trigger the planner's periodic optimization timer callback and drive resource exhaustion that hangs or crashes the exploration_manager node, denying service to the autonomous planning stack. For drone swarm deployments this could halt exploration mid-mission and impact aircraft availability. The tested affected version is the specific upstream commit 'abcdef1234567890'; no patched release is identified in the available data. No public proof of concept exists, the issue is not on CISA's KEV list, and no exploitation in the wild has been reported.

What to do: Do not run the exploration_manager node or expose ROS topics/services/DDS traffic on untrusted networks — place robots behind a firewall or VPN, since exploitation requires network reachability to the planner. Monitor CPU/memory of the exploration_manager process and watchdog the FSM so a resource-exhaustion hang fails safe during flight. Track the upstream Robotics-STAR-Lab repository for a patched commit and re-pin deployments once a fix is published.