CVE-2025-11011

Katalog CVE

CVSS 5.5 · Medium EPSS 0,21%

Kerentanan Improper Resource Shutdown or Release pada behaviortree. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in BehaviorTree up to 4.7.0. Affected by this issue is the function JsonExporter::fromJson of the file /src/json_export.cpp. Performing manipulation of the argument Source results in null pointer dereference. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is named 4b23dcaf0ce951a31299ebdd61df69f9ce99a76d. It is suggested to install a patch to address this issue.

Rincian

Terbit di NVD

26 September 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-404: Improper Resource Shutdown or Release
CWE-476: NULL Pointer Dereference

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 9,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/BehaviorTree/BehaviorTree.CPP/commit/4b23dcaf0ce951a31299ebdd61df69f9ce99a76d patch
• https://github.com/BehaviorTree/BehaviorTree.CPP/issues/1008 exploit · issue tracking · advisory pihak ketiga
• https://vuldb.com/?id.325954 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.654073 advisory pihak ketiga · vdb entry
• https://github.com/user-attachments/files/22270928/poc.zip exploit
• https://github.com/BehaviorTree/BehaviorTree.CPP/pull/1009 issue tracking
• https://vuldb.com/?ctiid.325954 permissions required · vdb entry