CVE-2026-71640 in EGO-Planner-v2
Summary
by MITRE • 09/11/2026
An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows unsafe vehicle motion via improper handling of expired trajectory data in the replanning pipeline
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2026
The vulnerability identified within ZJU-FAST-Lab EGO-Planner-v2, specifically affecting all versions up to commit 5c99a95880401e2599638d567abc0e240396cb42, represents a critical flaw in the temporal management of trajectory data within autonomous vehicle planning systems. EGO-Planner is designed to generate safe and efficient paths for unmanned ground vehicles by continuously replanning trajectories based on real-time sensor inputs and environmental models. The core issue lies in how the system handles expired or stale trajectory segments during the replanning pipeline. When a previously computed trajectory segment expires due to time constraints or changes in the planning horizon, the software fails to properly invalidate or discard this data before it is considered for execution or further processing. This improper handling creates a scenario where outdated spatial and temporal information can influence current motion decisions, leading to unsafe vehicle behavior that contradicts the intended safety guarantees of the planner.
From a technical perspective, this flaw constitutes an improper input validation error regarding time-based state management. The vulnerability allows expired trajectory data to persist in memory or be incorrectly referenced by subsequent planning cycles. In autonomous driving architectures, planners rely on strict temporal consistency between perception updates and motion commands. When stale data is not explicitly cleared or marked as invalid upon expiration, the control system may attempt to follow a path that no longer reflects the current state of the environment or the vehicle's actual position relative to obstacles. This can result in the generation of kinematically infeasible paths or trajectories that lead directly into collision zones because the planner is optimizing against outdated obstacle positions or map features. The lack of robust expiration logic means that the system does not enforce a clean slate for new planning iterations, allowing ghost data from previous cycles to contaminate current decision-making processes.
The operational impact of this vulnerability is severe and potentially catastrophic in real-world deployment scenarios. An autonomous vehicle relying on EGO-Planner-v2 could exhibit erratic motion patterns, such as sudden jerks, unexpected stops, or deviations into unsafe areas. In high-speed environments, following an expired trajectory that assumes the presence of obstacles which have since moved away can cause unnecessary braking and traffic disruption. Conversely, if the expiration logic fails to account for newly appeared obstacles because it is still referencing old free-space data, the vehicle may proceed directly toward a collision. This compromises both passenger safety and pedestrian security, violating fundamental principles of functional safety in automotive systems. The risk is exacerbated in dynamic environments where object movement is rapid, as the window between an obstacle moving into position and the planner detecting it becomes critically narrow if stale trajectory assumptions are not discarded immediately.
This vulnerability aligns with CWE-20 Improper Input Validation, specifically regarding the failure to validate temporal constraints on data inputs. It also relates to CWE-367 Time-of-check Time-of-use (TOCTOU) race conditions in a broader sense, as the system checks for trajectory validity at one point but uses potentially stale information later without re-verifying its current relevance. In terms of the MITRE ATT&CK framework, this flaw facilitates lateral movement or persistence if an attacker were to manipulate sensor data to trigger specific timing windows that exploit this expiration bug, although it is primarily a reliability and safety issue rather than a direct exploitation vector for remote code execution. The vulnerability highlights the importance of rigorous state management in cyber-physical systems where software decisions have immediate physical consequences.
Mitigation strategies must focus on implementing strict lifecycle management for trajectory data structures within the replanning pipeline. Developers should enforce explicit invalidation mechanisms that immediately mark expired trajectories as unusable and prevent them from being accessed by downstream modules such as controllers or executors. Implementing robust timestamp checks before any trajectory segment is selected ensures that only current, valid paths are considered during optimization. Additionally, integrating formal verification methods to test edge cases involving rapid environmental changes can help identify similar temporal logic errors. Updating to a patched version of EGO-Planner-v2 beyond the specified commit hash resolves this issue by correcting the internal handling of trajectory expiration. Until an update is applied, operators should monitor system logs for anomalies in planning frequency and ensure that fallback safety mechanisms are active to override any potentially unsafe commands generated by the flawed planner logic.