A vulnerability was found in BehaviorTree up to 4.7.0. Affected by this issue is the function JsonExporter::fromJson of the file /src/json_export.cpp. Performing manipulation of the argument Source results in null pointer dereference. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is named 4b23dcaf0ce951a31299ebdd61df69f9ce99a76d. It is suggested to install a patch to address this issue.
Fix
Patch, vendor advisory and mitigation references on NVD 1
- https://github.com/BehaviorTree/BehaviorTree.CPP/commit/4b23dcaf0ce951a31299ebdd61df69f9ce99a76d Patch
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 1.9 · behaviortreeNVD modified 2026-10-19 16:10
Affected (CPE criteria) 1
cpe:2.3:a:behaviortree:behaviortree:*:*:*:*:*:*:*:*
References 7
- https://github.com/BehaviorTree/BehaviorTree.CPP/commit/4b23dcaf0ce951a31299ebdd61df69f9ce99a76d Patch
- https://github.com/BehaviorTree/BehaviorTree.CPP/issues/1008 Exploit, Issue Tracking, Third Party Advisory
- https://github.com/BehaviorTree/BehaviorTree.CPP/pull/1009 Issue Tracking
- https://github.com/user-attachments/files/22270928/poc.zip Exploit
- https://vuldb.com/?ctiid.325954 Permissions Required, VDB Entry
- https://vuldb.com/?id.325954 Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.654073 Third Party Advisory, VDB Entry