PT-2025-39633 · Unknown · Behaviortree

Sand · Published 2025-09-26 · Updated 2025-10-16 · CVE-2025-11012

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BehaviorTree versions prior to 4.7.0

Description A flaw exists in BehaviorTree that could lead to a stack-based buffer overflow. This issue is related to the manipulation of the error msgs buffer argument within the ParseScript function located in the /src/script parser.cpp file of the Diagnostic Message Handler component. The exploit has been publicly disclosed and can be executed locally.

Recommendations Apply the patch cb6c7514efa628adb8180b58b4c9ccdebbe096e3 to remediate this issue.

Exploit

Fix

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-119

Related Identifiers

CVE-2025-11012

Affected Products

Behaviortree

References · 14

• 🔥 https://github.com/BehaviorTree/BehaviorTree.CPP/issues/1006 · Exploit
• 🔥❌ https://github.com/user-attachments/files/22251337/poc.zip · Exploit, Deleted
• https://github.com/BehaviorTree/BehaviorTree.CPP/commit/cb6c7514efa628adb8180b58b4c9ccdebbe096e3 · Patch
• https://osv.dev/vulnerability/CVE-2025-11012 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11012 · Security Note
• https://github.com/BehaviorTree/BehaviorTree.CPP/pull/1007 · Note
• https://t.me/CVEtracker/33458 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1971560806744473836 · Twitter Post
• https://vuldb.com/?ctiid.325955 · Note
• https://t.me/cveNotify/138990 · Telegram Post
• https://t.me/cveNotify/136524 · Telegram Post
• https://vuldb.com/?id.325955 · Note
• https://vuldb.com/?submit.654074 · Note
• https://twitter.com/CVEnew/status/1971539536506245139 · Twitter Post