CVE-2025-11013

MediumCVSS 5.5/10Last modified Oct 19, 2026

Description

A vulnerability was identified in BehaviorTree up to 4.7.0. This vulnerability affects the function XMLParser::PImpl::loadDocImpl of the file /src/xml_parsing.cpp of the component XML Parser. The manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit is publicly available and might be used.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-404 CWE-476

Affected software

Vendor	Product	Versions
n/a	BehaviorTree	4.0; 4.1; 4.2; 4.3; 4.4; 4.5; 4.6; 4.7.0

References

https://github.com/BehaviorTree/BehaviorTree.CPP/issues/1003Exploit, Issue Tracking
https://github.com/BehaviorTree/BehaviorTree.CPP/pull/1004Issue Tracking
https://github.com/user-attachments/files/22245915/poc.zipExploit
https://vuldb.com/?ctiid.325956Permissions Required, VDB Entry
https://vuldb.com/?id.325956Third Party Advisory, VDB Entry
https://vuldb.com/?submit.654075Third Party Advisory, VDB Entry
https://github.com/BehaviorTree/BehaviorTree.CPP/issues/1003Exploit, Issue Tracking
https://github.com/user-attachments/files/22245915/poc.zipExploit

Timeline

Published: Sep 26, 2025
Last modified: Oct 19, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-110147.8A security flaw has been discovered in OGRECave Ogre up to 14.4.1. This issue affects the function STBIImageCodec::encode of the file /ogre/CVE-2025-110155.3A weakness has been identified in OGRECave Ogre up to 14.4.1. Impacted is the function STBIImageCodec::encode of the file /ogre/PlugIns/STBI CVE-2025-110164.3A security vulnerability has been detected in kalcaddle kodbox up to 1.61.09. The affected element is the function fileOut of the file app/c CVE-2025-110175.5A vulnerability was detected in OGRECave Ogre up to 14.4.1. The impacted element is the function Ogre::LogManager::stream of the file /ogre/CVE-2025-110187.5A flaw has been found in Four-Faith Water Conservancy Informatization Platform 1.0. This affects an unknown function of the file /sysRole/in CVE-2025-110194.8A vulnerability has been found in Total.js CMS up to 19.9.0. This impacts an unknown function of the component Files Menu. The manipulation CVE-2025-11027.1A CWE-346 "Origin Validation Error" in the CORS configuration in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticat CVE-2025-110208.8An attacker can obtain server information using Path Traversal vulnerability to conduct SQL Injection, which possibly exploits Unrestricted CVE-2025-110217.5A flaw was found in the cookie date handling logic of the libsoup HTTP library, widely used by GNOME and other applications for web communic CVE-2025-110229.6Cross-Site Request Forgery (CSRF) vulnerability in Personal Project Panilux allows Cross Site Request Forgery. This CSRF vulnerability r CVE-2025-110239.8Inclusion of Functionality from Untrusted Control Sphere, Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Re CVE-2025-110249.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Akilli Commerce Software Technologies