Home

Description

EN DE

A vulnerability was found in BehaviorTree up to 4.7.0. Affected by this issue is the function JsonExporter::fromJson of the file /src/json_export.cpp. Performing manipulation of the argument Source results in null pointer dereference. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is named 4b23dcaf0ce951a31299ebdd61df69f9ce99a76d. It is suggested to install a patch to address this issue.

In BehaviorTree up to 4.7.0 wurde eine Schwachstelle gefunden. Es geht um die Funktion JsonExporter::fromJson der Datei /src/json_export.cpp. Mittels Manipulieren des Arguments Source mit unbekannten Daten kann eine null pointer dereference-Schwachstelle ausgenutzt werden. Der Angriff muss lokal angegangen werden. Die Ausnutzung wurde veröffentlicht und kann verwendet werden. Die Bezeichnung des Patches lautet 4b23dcaf0ce951a31299ebdd61df69f9ce99a76d. Es ist ratsam, einen Patch zu implementieren, um dieses Problem zu beheben.

PUBLISHED Reserved 2025-09-26 | Published 2025-09-26 | Updated 2025-09-26 | Assigner VulDB




MEDIUM: 4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
LOW: 3.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
LOW: 3.3CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
1.7AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C

Problem types

NULL Pointer Dereference

Denial of Service

Timeline

2025-09-26:Advisory disclosed
2025-09-26:VulDB entry created
2025-09-26:VulDB entry last update

Credits

sand (VulDB User) reporter

References

vuldb.com/?id.325954 (VDB-325954 | BehaviorTree json_export.cpp fromJson null pointer dereference) vdb-entry technical-description

vuldb.com/?ctiid.325954 (VDB-325954 | CTI Indicators (IOB, IOC, IOA)) signature permissions-required

vuldb.com/?submit.654073 (Submit #654073 | Davide Faconti BehaviorTree 4.7.0 / master commit 8d47d39 NULL Pointer Dereference) third-party-advisory

github.com/BehaviorTree/BehaviorTree.CPP/issues/1008 issue-tracking

github.com/BehaviorTree/BehaviorTree.CPP/pull/1009 issue-tracking

github.com/user-attachments/files/22270928/poc.zip exploit

github.com/...ommit/4b23dcaf0ce951a31299ebdd61df69f9ce99a76d patch

cve.org (CVE-2025-11011)

nvd.nist.gov (CVE-2025-11011)

Download JSON