CVE-2025-11011

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-11011
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-11011.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-11011
Published
2025-09-26T12:15:34.840Z
Modified
2026-04-12T17:58:59.982983Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

A vulnerability was found in BehaviorTree up to 4.7.0. Affected by this issue is the function JsonExporter::fromJson of the file /src/json_export.cpp. Performing manipulation of the argument Source results in null pointer dereference. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is named 4b23dcaf0ce951a31299ebdd61df69f9ce99a76d. It is suggested to install a patch to address this issue.

References

Affected packages

Git / github.com/behaviortree/behaviortree.cpp

Affected ranges

Type
GIT
Repo
https://github.com/behaviortree/behaviortree.cpp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9b3e791f8c09845866bf50faf2c56d7bcd99ea42
Fixed
4b23dcaf0ce951a31299ebdd61df69f9ce99a76d
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.7.3"
        }
    ]
}

Affected versions

2.*
2.0-beta
2.1.0
2.3.0
2.4.0
2.4.1
2.4.4
2.5.0
2.5.1
3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.0.5
3.0.6
3.0.7
3.1.0
3.1.1
3.3.0
3.4.0
3.5.0
3.5.1
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.6.0
3.6.1
3.7.0
4.*
4.0.1
4.1.0
4.1.1
4.2.0
4.2.1
4.3.0
4.3.1
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.6.0
4.6.1
4.6.2
4.7.0
4.7.1
4.7.2

Database specific

vanir_signatures_modified 
"2026-04-12T17:58:59Z"
vanir_signatures 
[
    {
        "source": "https://github.com/behaviortree/behaviortree.cpp/commit/4b23dcaf0ce951a31299ebdd61df69f9ce99a76d",
        "target": {
            "function": "JsonExporter::fromJson",
            "file": "src/json_export.cpp"
        },
        "id": "CVE-2025-11011-c8aa4a45",
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "function_hash": "307603990121936318144611016592771030576",
            "length": 2200.0
        }
    },
    {
        "source": "https://github.com/behaviortree/behaviortree.cpp/commit/4b23dcaf0ce951a31299ebdd61df69f9ce99a76d",
        "target": {
            "file": "src/json_export.cpp"
        },
        "id": "CVE-2025-11011-d875e193",
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "71516065837274542130269582653546580651",
                "242457547332974366142313148446464518651",
                "337889368400230636724328403501133058513",
                "130942906083815560765819713068092021460",
                "156991336510209514156368153832773281192",
                "182825769560649025925428859354400031850"
            ],
            "threshold": 0.9
        }
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-11011.json"