Null Pointer Dereference Vulnerability in BehaviorTree XML Parser by Davide Faconti
CVE-2025-11013

4.8MEDIUM

Key Information:

Vendor: Davide Faconti
Status: Behaviortree
Vendor: CVE Published:; 26 September 2025

🔔 Create Davide Faconti Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-11013?

A security flaw has been discovered in BehaviorTree's XML Parser component, specifically within the XMLParser::PImpl::loadDocImpl function. This vulnerability can be exploited to cause a null pointer dereference, intending to disrupt the normal operation of the software. The attack requires local access to the environment where the software is running, making it accessible primarily to authors or users with local permissions. There are known public exploits that can trigger this issue, emphasizing the necessity for users and administrators to apply the available patches and follow best security practices to mitigate the risk.

Affected Version(s)

BehaviorTree 4.0

BehaviorTree 4.1

BehaviorTree 4.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-11013 - Proof of Concept