CVE-2025-11013

A vulnerability was identified in BehaviorTree up to 4.7.0. This vulnerability affects the function XMLParser::PImpl::loadDocImpl of the file /src/xml_parsing.cpp of the component XML Parser. The manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit is publicly available and might be used.

• CWE-404
• CWE-476
• CWE-476

• https://github.com/BehaviorTree/BehaviorTree.CPP/issues/1003Exploit, Issue Tracking
• https://github.com/BehaviorTree/BehaviorTree.CPP/pull/1004Issue Tracking
• https://github.com/user-attachments/files/22245915/poc.zipExploit
• https://vuldb.com/?ctiid.325956Permissions Required, VDB Entry
• https://vuldb.com/?id.325956Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.654075Third Party Advisory, VDB Entry
• https://github.com/BehaviorTree/BehaviorTree.CPP/issues/1003Exploit, Issue Tracking
• https://github.com/user-attachments/files/22245915/poc.zipExploit

Published

Sep 26, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-11008The CE21 Suite plugin for WordPress is vulnerable to Sensiti…9.8
• CVE-2025-11009Cleartext Storage of Sensitive Information vulnerability in …5.1
• CVE-2025-1101A CWE-204 "Observable Response Discrepancy" in the login pag…5.3
• CVE-2025-11010A vulnerability has been found in vstakhov libucl up to 0.9.…5.3
• CVE-2025-11011A vulnerability was found in BehaviorTree up to 4.7.0. Affec…5.5
• CVE-2025-11012A vulnerability was determined in BehaviorTree up to 4.7.0. …7.8
• CVE-2025-11014A security flaw has been discovered in OGRECave Ogre up to 1…7.8
• CVE-2025-11015A weakness has been identified in OGRECave Ogre up to 14.4.1…5.3
• CVE-2025-11016A security vulnerability has been detected in kalcaddle kodb…4.3
• CVE-2025-11017A vulnerability was detected in OGRECave Ogre up to 14.4.1. …5.5
• CVE-2025-11018A flaw has been found in Four-Faith Water Conservancy Inform…7.5
• CVE-2025-11019A vulnerability has been found in Total.js CMS up to 19.9.0.…4.8