CVE-2025-11012
📋 TL;DR
A stack-based buffer overflow vulnerability exists in BehaviorTree up to version 4.7.0, specifically in the ParseScript function of the Diagnostic Message Handler. This allows local attackers to execute arbitrary code by manipulating the error_msgs_buffer argument. Only systems running vulnerable versions of BehaviorTree are affected.
💻 Affected Systems
- BehaviorTree.CPP
📦 What is this software?
Behaviortree by Behaviortree
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to full system compromise, data theft, or persistent backdoor installation.
Likely Case
Local user gains elevated privileges or crashes the application, potentially disrupting dependent services.
If Mitigated
Limited impact due to local-only exploitation requirement and proper access controls.
🎯 Exploit Status
Proof-of-concept exploit is publicly available in the provided poc.zip file. Exploitation requires local access to the system.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after commit cb6c7514efa628adb8180b58b4c9ccdebbe096e3
Vendor Advisory: https://github.com/BehaviorTree/BehaviorTree.CPP/issues/1006
Restart Required: No
Instructions:
1. Update BehaviorTree.CPP to version after commit cb6c7514efa628adb8180b58b4c9ccdebbe096e3. 2. Rebuild any applications using BehaviorTree. 3. Test functionality after update.
🔧 Temporary Workarounds
Restrict local access
allLimit local user access to systems running vulnerable BehaviorTree versions
Disable Diagnostic Message Handler
allIf not required, disable the affected component to prevent exploitation
🧯 If You Can't Patch
- Implement strict access controls to limit local user privileges
- Monitor for unusual process behavior or crashes related to BehaviorTree
🔍 How to Verify
Check if Vulnerable:
Check BehaviorTree version: if version <= 4.7.0, system is vulnerableCheck Version:
Check build configuration or package manager for BehaviorTree versionVerify Fix Applied:
Verify BehaviorTree version is > 4.7.0 or includes commit cb6c7514efa628adb8180b58b4c9ccdebbe096e3📡 Detection & Monitoring
Log Indicators:
- Application crashes in BehaviorTree components
- Unusual process spawns from BehaviorTree executables
Network Indicators:
- None - local-only vulnerability
SIEM Query:
Process creation events from BehaviorTree executables with unusual arguments or crash reports🔗 References
- https://github.com/BehaviorTree/BehaviorTree.CPP/commit/cb6c7514efa628adb8180b58b4c9ccdebbe096e3
- https://github.com/BehaviorTree/BehaviorTree.CPP/issues/1006
- https://github.com/BehaviorTree/BehaviorTree.CPP/pull/1007
- https://github.com/user-attachments/files/22251337/poc.zip
- https://vuldb.com/?ctiid.325955
- https://vuldb.com/?id.325955
- https://vuldb.com/?submit.654074
