CVE-2025-11011

LOW EPSS 8.6%

Published Sep 26, 20259mo ago · Modified Jun 17, 20261w ago

1.9 CVSS 4.0

Low

Published Sep 26, 2025 9mo ago

Last Modified Jun 17, 2026 1w ago

Description

A vulnerability was found in BehaviorTree up to 4.7.0. Affected by this issue is the function JsonExporter::fromJson of the file /src/json_export.cpp. Performing manipulation of the argument Source results in null pointer dereference. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is named 4b23dcaf0ce951a31299ebdd61df69f9ce99a76d. It is suggested to install a patch to address this issue.

CVSS Details

Base Score

1.9

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector Local

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope X

Threat Intelligence

EPSS Exploit Probability

8.6% percentile

Exploit & Patch Status

Public Exploit Known

Patch Available

Weaknesses 2

CWE-404

CWE-476 NULL Pointer Dereference Memory Safety

Affected Products 1

Vendor	Product	Version	Range
behaviortree	behaviortree	*	<4.7.3

References 7

github.com https://github.com/BehaviorTree/BehaviorTree.CPP/commit/4b23dcaf0ce951a31299ebdd61df69f9ce99a76d

Patch
github.com https://github.com/BehaviorTree/BehaviorTree.CPP/issues/1008

ExploitIssue TrackingThird Party Advisory
github.com https://github.com/BehaviorTree/BehaviorTree.CPP/pull/1009

Issue Tracking
github.com https://github.com/user-attachments/files/22270928/poc.zip

Exploit
vuldb.com https://vuldb.com/?ctiid.325954

Permissions RequiredVDB Entry
vuldb.com https://vuldb.com/?id.325954

Third Party AdvisoryVDB Entry
vuldb.com https://vuldb.com/?submit.654073

Third Party AdvisoryVDB Entry

Remediation

github.com https://github.com/BehaviorTree/BehaviorTree.CPP/commit/4b23dcaf0ce951a31299ebdd61df69f9ce99a76d

Patch