CVE-2026-71642 in EGO-Planner-v2
Summary
by MITRE • 09/10/2026
An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via the EGOReplanFSM::checkCollisionCallback()
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified in ZJU-FAST-Lab EGO-Planner-v2, specifically affecting all versions up to commit 5c99a95880401e2599638d567abc0e240396cb42, represents a critical reliability flaw within the robotic motion planning subsystem. EGO-Planner is an optimization-based trajectory planner designed for quadrotors and other aerial vehicles operating in complex environments. The core function of this software is to generate collision-free paths by continuously replanning trajectories based on real-time sensor data. The specific weakness resides in the state machine logic governing the emergency replanning process, particularly within the EGOReplanFSM::checkCollisionCallback() method. This callback is triggered when the planner detects a potential or actual collision with an obstacle during execution. Instead of gracefully handling unexpected edge cases or malformed input from perception modules, the implementation contains a logical error that leads to unhandled exceptions or infinite loops under certain conditions.
From a technical perspective, this flaw allows for a denial-of-service attack vector where an attacker can manipulate sensor inputs or exploit race conditions in the state machine transitions to trigger the faulty code path. When the checkCollisionCallback is invoked with specific malformed states or data structures resulting from adversarial manipulation of LiDAR point clouds or visual odometry feeds, the application fails to recover properly. This failure manifests as a crash of the planning process or a complete freeze of the control loop. In the context of autonomous systems, such a failure is catastrophic because it halts the vehicle's ability to navigate safely. The planner stops generating new trajectories, leaving the drone in an uncontrolled state that may lead to physical damage if not manually overridden by a human operator or a separate safety controller.
The operational impact of this vulnerability extends beyond simple software instability. For autonomous drones operating in populated areas or critical infrastructure environments, a denial-of-service event can result in loss of vehicle control, potential crashes, and significant property damage. Furthermore, because EGO-Planner is often integrated into larger autonomy stacks that rely on continuous availability for safe operation, this flaw compromises the overall integrity of the robotic system. An attacker with access to the sensor data stream or network interface controlling the drone could deliberately induce these collision check failures, effectively grounding the asset without needing direct control over its actuators. This aligns with common attack patterns where disrupting perception-to-planning pipelines is a primary objective for adversaries seeking to neutralize autonomous systems.
This vulnerability maps directly to CWE-20 Improper Input Validation and CWE-754: Improper Check for Unusual or Exceptional Conditions, as the software fails to adequately validate inputs within the collision checking routine before processing them in critical state transitions. Additionally, from a tactical perspective related to MITRE ATT&CK, this flaw facilitates techniques associated with Resource Hijacking (T1496) and Denial of Service against specific components of an embedded system. The attacker leverages the resource consumption or crash behavior to disrupt service availability. Mitigation strategies must focus on hardening the input validation layers within the perception pipeline and implementing robust exception handling mechanisms in the state machine logic. Developers should ensure that all callbacks, especially those triggered by external sensor data like collision checks, include comprehensive boundary checking and fail-safe defaults that prevent unhandled exceptions from propagating to the main control loop. Updating to a version of EGO-Planner-v2 released after commit 5c99a95880401e2599638d567abc0e240396cb42 is essential, as this specific revision likely contains the patch for these logical errors. Until an update can be applied, operators should implement external watchdogs that monitor planner liveness and trigger safe landing procedures if no new trajectory commands are received within a defined time window.