CVE-2025-11013

Sept. 26, 2025, 2:32 p.m.

4.8
Medium

Description

A vulnerability was identified in BehaviorTree up to 4.7.0. This vulnerability affects the function XMLParser::PImpl::loadDocImpl of the file /src/xml_parsing.cpp of the component XML Parser. The manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit is publicly available and might be used.

Product(s) Impacted

Vendor Product Versions
Behavior Tree
  • Behavior Tree
  • <=4.7.0

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-404
Improper Resource Shutdown or Release
The product does not release or incorrectly releases a resource before it is made available for re-use.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a behavior_tree behavior_tree <=4.7.0 / / / / / / /

References

https://github.com/BehaviorTree/BehaviorTree.CPP/issues/1003
https://github.com/BehaviorTree/BehaviorTree.CPP/pull/1004
https://github.com/user-attachments/files/22245915/poc.zip
https://vuldb.com/?ctiid.325956
https://vuldb.com/?id.325956
https://vuldb.com/?submit.654075
https://github.com/BehaviorTree/BehaviorTree.CPP/issues/1003
https://github.com/user-attachments/files/22245915/poc.zip

Tags

cna@vuldb.com
CWE-404
2025-09-26
CVE-2025-11013

CVSS Score

4.8 / 10

CVSS Data - 4.0

  • Attack Vector: LOCAL
  • Attack Complexity: LOW
  • Attack Requirements: NONE
  • Privileges Required: LOW
  • User Interaction: NONE
  • Scope:
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: LOW
  • Exploit Maturity: PROOF_OF_CONCEPT

    • CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

    View Vector String

Timeline

Published: Sept. 26, 2025, 1:15 p.m.
Last Modified: Sept. 26, 2025, 2:32 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cna@vuldb.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.