Description
A vulnerability was identified in BehaviorTree up to 4.7.0. This vulnerability affects the function XMLParser::PImpl::loadDocImpl of the file /src/xml_parsing.cpp of the component XML Parser. The manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit is publicly available and might be used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | BehaviorTree | 4.0, 4.1, 4.2, 4.3, 4.4, 4.5, 4.6, 4.7.0 | — |
References
- VDB-325956 | BehaviorTree XML Parser xml_parsing.cpp loadDocImpl null pointer dereference vdb-entry technical-description
- VDB-325956 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #654075 | Davide Faconti BehaviorTree 4.7.0 / master commit 8d47d39 NULL Pointer Dereference third-party-advisory
- https://github.com/BehaviorTree/BehaviorTree.CPP/issues/1003 issue-tracking
- https://github.com/BehaviorTree/BehaviorTree.CPP/pull/1004 issue-tracking
- https://github.com/user-attachments/files/22245915/poc.zip exploit