Vulnerability-Lookup

CVE-2025-11015 (GCVE-0-2025-11015)

Vulnerability from cvelistv5 – Published: 2025-09-26 13:32 – Updated: 2025-09-26 19:53

Title

OGRECave Ogre OgreSTBICodec.cpp encode mismatched memory management routines

Summary

A weakness has been identified in OGRECave Ogre up to 14.4.1. Impacted is the function STBIImageCodec::encode of the file /ogre/PlugIns/STBICodec/src/OgreSTBICodec.cpp. This manipulation causes mismatched memory management routines. The attack is restricted to local execution. The exploit has been made available to the public and could be exploited.

Severity

4.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

5.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

5.3 (Medium)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-09-26 19:53 UTC

CWE

CWE-762 - Mismatched Memory Management Routines
CWE-119 - Memory Corruption

Assigner

VulDB CNA under the mitre root

CNA scorecard B 82/100 over 3876 records in the last 180 days details

References

5 references

URL	Tags
https://vuldb.com/?id.325958	vdb-entrytechnical-description
https://vuldb.com/?ctiid.325958	signaturepermissions-required
https://vuldb.com/?submit.654340	third-party-advisory
https://github.com/OGRECave/ogre/issues/3446	issue-tracking
https://github.com/user-attachments/files/2232821…	exploit

Impacted products

1 product

Vendor	Product	Version	CPE status
OGRECave	Ogre	Affected: 14.4.0 Affected: 14.4.1	guessed

Credits

sand (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-11015",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-26T19:53:43.185313Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-26T19:53:54.435Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Ogre",
          "vendor": "OGRECave",
          "versions": [
            {
              "status": "affected",
              "version": "14.4.0"
            },
            {
              "status": "affected",
              "version": "14.4.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "sand (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A weakness has been identified in OGRECave Ogre up to 14.4.1. Impacted is the function STBIImageCodec::encode of the file /ogre/PlugIns/STBICodec/src/OgreSTBICodec.cpp. This manipulation causes mismatched memory management routines. The attack is restricted to local execution. The exploit has been made available to the public and could be exploited."
        },
        {
          "lang": "de",
          "value": "In OGRECave Ogre up to 14.4.1 wurde eine Schwachstelle gefunden. Hierbei geht es um die Funktion STBIImageCodec::encode der Datei /ogre/PlugIns/STBICodec/src/OgreSTBICodec.cpp. Durch Beeinflussen mit unbekannten Daten kann eine mismatched memory management routines-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs hat dabei lokal zu erfolgen. Der Exploit ist \u00f6ffentlich verf\u00fcgbar und k\u00f6nnte genutzt werden."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4.3,
            "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-762",
              "description": "Mismatched Memory Management Routines",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "Memory Corruption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-26T13:32:06.704Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-325958 | OGRECave Ogre OgreSTBICodec.cpp encode mismatched memory management routines",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.325958"
        },
        {
          "name": "VDB-325958 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.325958"
        },
        {
          "name": "Submit #654340 | Ogre3D Ogre v14.4.1 / master commit f629d22  Mismatched Memory Management Routines",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.654340"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/OGRECave/ogre/issues/3446"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/user-attachments/files/22328216/poc.zip"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-09-26T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2025-09-26T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2025-09-26T08:45:59.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "OGRECave Ogre OgreSTBICodec.cpp encode mismatched memory management routines"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2025-11015",
    "datePublished": "2025-09-26T13:32:06.704Z",
    "dateReserved": "2025-09-26T06:40:50.545Z",
    "dateUpdated": "2025-09-26T19:53:54.435Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-11015",
      "date": "2026-10-13",
      "epss": "0.00145",
      "percentile": "0.03348"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "Ogre",
                "vendor": "OGRECave",
                "versions": [
                  {
                    "status": "affected",
                    "version": "14.4.0"
                  },
                  {
                    "status": "affected",
                    "version": "14.4.1"
                  }
                ]
              }
            ],
            "source": "cna@vuldb.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A weakness has been identified in OGRECave Ogre up to 14.4.1. Impacted is the function STBIImageCodec::encode of the file /ogre/PlugIns/STBICodec/src/OgreSTBICodec.cpp. This manipulation causes mismatched memory management routines. The attack is restricted to local execution. The exploit has been made available to the public and could be exploited."
          },
          {
            "lang": "es",
            "value": "Se ha identificado una debilidad en OGRECave Ogre hasta la versi\u00f3n 14.4.1. La funci\u00f3n afectada es STBIImageCodec::encode del archivo /ogre/PlugIns/STBICodec/src/OgreSTBICodec.cpp. Esta manipulaci\u00f3n causa rutinas de gesti\u00f3n de memoria no coincidentes. El ataque est\u00e1 restringido a ejecuci\u00f3n local. El exploit ha sido puesto a disposici\u00f3n del p\u00fablico y podr\u00eda ser explotado."
          }
        ],
        "id": "CVE-2025-11015",
        "lastModified": "2026-10-09T10:10:00.193",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "LOCAL",
                "authentication": "SINGLE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 4.3,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 3.1,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "cna@vuldb.com",
              "type": "Secondary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "LOW",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.4,
              "source": "cna@vuldb.com",
              "type": "Secondary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "LOCAL",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 1.9,
                "baseSeverity": "LOW",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "PROOF_OF_CONCEPT",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "LOW",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "LOW",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "cna@vuldb.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-11015",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-26T19:53:43.185313Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-09-26T14:15:41.583",
        "references": [
          {
            "source": "cna@vuldb.com",
            "url": "https://github.com/OGRECave/ogre/issues/3446"
          },
          {
            "source": "cna@vuldb.com",
            "url": "https://github.com/user-attachments/files/22328216/poc.zip"
          },
          {
            "source": "cna@vuldb.com",
            "url": "https://vuldb.com/?ctiid.325958"
          },
          {
            "source": "cna@vuldb.com",
            "url": "https://vuldb.com/?id.325958"
          },
          {
            "source": "cna@vuldb.com",
            "url": "https://vuldb.com/?submit.654340"
          }
        ],
        "sourceIdentifier": "cna@vuldb.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-119"
              },
              {
                "lang": "en",
                "value": "CWE-762"
              }
            ],
            "source": "cna@vuldb.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-09-27T13:49:17+00:00",
      "cve": "CVE-2025-11015",
      "id": "CVE-2025-11015",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "OGRECave Ogre OgreSTBICodec.cpp encode mismatched memory management routines",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-11015.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-11015",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-09-26T19:53:43.185313Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-09-26T19:53:49.647Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "Ogre",
              "vendor": "OGRECave",
              "versions": [
                {
                  "status": "affected",
                  "version": "14.4.0"
                },
                {
                  "status": "affected",
                  "version": "14.4.1"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "reporter",
              "value": "sand (VulDB User)"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "A weakness has been identified in OGRECave Ogre up to 14.4.1. Impacted is the function STBIImageCodec::encode of the file /ogre/PlugIns/STBICodec/src/OgreSTBICodec.cpp. This manipulation causes mismatched memory management routines. The attack is restricted to local execution. The exploit has been made available to the public and could be exploited."
            },
            {
              "lang": "de",
              "value": "In OGRECave Ogre up to 14.4.1 wurde eine Schwachstelle gefunden. Hierbei geht es um die Funktion STBIImageCodec::encode der Datei /ogre/PlugIns/STBICodec/src/OgreSTBICodec.cpp. Durch Beeinflussen mit unbekannten Daten kann eine mismatched memory management routines-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs hat dabei lokal zu erfolgen. Der Exploit ist \u00f6ffentlich verf\u00fcgbar und k\u00f6nnte genutzt werden."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "baseScore": 4.8,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
                "version": "4.0"
              }
            },
            {
              "cvssV3_1": {
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
                "version": "3.1"
              }
            },
            {
              "cvssV3_0": {
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
                "version": "3.0"
              }
            },
            {
              "cvssV2_0": {
                "baseScore": 4.3,
                "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
                "version": "2.0"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-762",
                  "description": "Mismatched Memory Management Routines",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-119",
                  "description": "Memory Corruption",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-09-26T13:32:06.704Z",
            "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
            "shortName": "VulDB"
          },
          "references": [
            {
              "name": "VDB-325958 | OGRECave Ogre OgreSTBICodec.cpp encode mismatched memory management routines",
              "tags": [
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://vuldb.com/?id.325958"
            },
            {
              "name": "VDB-325958 | CTI Indicators (IOB, IOC, IOA)",
              "tags": [
                "signature",
                "permissions-required"
              ],
              "url": "https://vuldb.com/?ctiid.325958"
            },
            {
              "name": "Submit #654340 | Ogre3D Ogre v14.4.1 / master commit f629d22  Mismatched Memory Management Routines",
              "tags": [
                "third-party-advisory"
              ],
              "url": "https://vuldb.com/?submit.654340"
            },
            {
              "tags": [
                "issue-tracking"
              ],
              "url": "https://github.com/OGRECave/ogre/issues/3446"
            },
            {
              "tags": [
                "exploit"
              ],
              "url": "https://github.com/user-attachments/files/22328216/poc.zip"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2025-09-26T00:00:00.000Z",
              "value": "Advisory disclosed"
            },
            {
              "lang": "en",
              "time": "2025-09-26T02:00:00.000Z",
              "value": "VulDB entry created"
            },
            {
              "lang": "en",
              "time": "2025-09-26T08:45:59.000Z",
              "value": "VulDB entry last update"
            }
          ],
          "title": "OGRECave Ogre OgreSTBICodec.cpp encode mismatched memory management routines"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "assignerShortName": "VulDB",
        "cveId": "CVE-2025-11015",
        "datePublished": "2025-09-26T13:32:06.704Z",
        "dateReserved": "2025-09-26T06:40:50.545Z",
        "dateUpdated": "2025-09-26T19:53:54.435Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2025-11015

Vulnerability from fkie_nvd - Published: 2025-09-26 14:15 - Updated: 2026-10-09 10:10

Severity

5.3 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Summary

References

	URL	Tags
	cna@vuldb.com	https://github.com/OGRECave/ogre/issues/3446
	cna@vuldb.com	https://github.com/user-attachments/files/22328216/poc.zip
	cna@vuldb.com	https://vuldb.com/?ctiid.325958
	cna@vuldb.com	https://vuldb.com/?id.325958
	cna@vuldb.com	https://vuldb.com/?submit.654340

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Ogre",
          "vendor": "OGRECave",
          "versions": [
            {
              "status": "affected",
              "version": "14.4.0"
            },
            {
              "status": "affected",
              "version": "14.4.1"
            }
          ]
        }
      ],
      "source": "cna@vuldb.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A weakness has been identified in OGRECave Ogre up to 14.4.1. Impacted is the function STBIImageCodec::encode of the file /ogre/PlugIns/STBICodec/src/OgreSTBICodec.cpp. This manipulation causes mismatched memory management routines. The attack is restricted to local execution. The exploit has been made available to the public and could be exploited."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una debilidad en OGRECave Ogre hasta la versi\u00f3n 14.4.1. La funci\u00f3n afectada es STBIImageCodec::encode del archivo /ogre/PlugIns/STBICodec/src/OgreSTBICodec.cpp. Esta manipulaci\u00f3n causa rutinas de gesti\u00f3n de memoria no coincidentes. El ataque est\u00e1 restringido a ejecuci\u00f3n local. El exploit ha sido puesto a disposici\u00f3n del p\u00fablico y podr\u00eda ser explotado."
    }
  ],
  "id": "CVE-2025-11015",
  "lastModified": "2026-10-09T10:10:00.193",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 4.3,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "cna@vuldb.com",
        "type": "Secondary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "LOW",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.4,
        "source": "cna@vuldb.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 1.9,
          "baseSeverity": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "cna@vuldb.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-11015",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-09-26T19:53:43.185313Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-09-26T14:15:41.583",
  "references": [
    {
      "source": "cna@vuldb.com",
      "url": "https://github.com/OGRECave/ogre/issues/3446"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://github.com/user-attachments/files/22328216/poc.zip"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://vuldb.com/?ctiid.325958"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://vuldb.com/?id.325958"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://vuldb.com/?submit.654340"
    }
  ],
  "sourceIdentifier": "cna@vuldb.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        },
        {
          "lang": "en",
          "value": "CWE-762"
        }
      ],
      "source": "cna@vuldb.com",
      "type": "Secondary"
    }
  ]
}

GHSA-JMM8-JQF2-7X8J

Vulnerability from github – Published: 2025-09-26 15:30 – Updated: 2025-09-26 15:30

Details

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

1.9 (Low)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-11015"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-26T14:15:41Z",
    "severity": "MODERATE"
  },
  "details": "A weakness has been identified in OGRECave Ogre up to 14.4.1. Impacted is the function STBIImageCodec::encode of the file /ogre/PlugIns/STBICodec/src/OgreSTBICodec.cpp. This manipulation causes mismatched memory management routines. The attack is restricted to local execution. The exploit has been made available to the public and could be exploited.",
  "id": "GHSA-jmm8-jqf2-7x8j",
  "modified": "2025-09-26T15:30:28Z",
  "published": "2025-09-26T15:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11015"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OGRECave/ogre/issues/3446"
    },
    {
      "type": "WEB",
      "url": "https://github.com/user-attachments/files/22328216/poc.zip"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.325958"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.325958"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.654340"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

UBUNTU-CVE-2025-11015 (CVE-2025-11015)

Vulnerability from osv_ubuntu – Published: 2025-09-26 14:15 – Updated: 2026-05-20 15:16 – Source website

Details

Severity

5.3 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

1.9 (Low)


                    
                      CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2025-11015	REPORT
	https://www.cve.org/CVERecord?id=CVE-2025-11015	REPORT
	https://github.com/OGRECave/ogre/issues/3446	REPORT
	https://github.com/user-attachments/files/2232821…	REPORT
	https://vuldb.com/?ctiid.325958	REPORT
	https://vuldb.com/?id.325958	REPORT
	https://vuldb.com/?submit.654340	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libogre-1.12",
            "binary_version": "1.12.4+dfsg1-4"
          },
          {
            "binary_name": "ogre-1.12-tools",
            "binary_version": "1.12.4+dfsg1-4"
          },
          {
            "binary_name": "python3-ogre-1.12",
            "binary_version": "1.12.4+dfsg1-4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "ogre-1.12",
        "purl": "pkg:deb/ubuntu/ogre-1.12@1.12.4+dfsg1-4?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.12.4+dfsg1-4"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libogre1.12.10",
            "binary_version": "1.12.10+dfsg2-1.2build1"
          },
          {
            "binary_name": "ogre-1.12-tools",
            "binary_version": "1.12.10+dfsg2-1.2build1"
          },
          {
            "binary_name": "python3-ogre-1.12",
            "binary_version": "1.12.10+dfsg2-1.2build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "ogre-1.12",
        "purl": "pkg:deb/ubuntu/ogre-1.12@1.12.10+dfsg2-1.2build1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.12.10+dfsg2-1.2",
        "1.12.10+dfsg2-1.2build1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libogre1.12.10t64",
            "binary_version": "1.12.10+dfsg2-3.1~exp1ubuntu3"
          },
          {
            "binary_name": "ogre-1.12-tools",
            "binary_version": "1.12.10+dfsg2-3.1~exp1ubuntu3"
          },
          {
            "binary_name": "python3-ogre-1.12",
            "binary_version": "1.12.10+dfsg2-3.1~exp1ubuntu3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "ogre-1.12",
        "purl": "pkg:deb/ubuntu/ogre-1.12@1.12.10+dfsg2-3.1~exp1ubuntu3?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.12.10+dfsg2-3build1",
        "1.12.10+dfsg2-3build2",
        "1.12.10+dfsg2-3.1~exp1ubuntu2",
        "1.12.10+dfsg2-3.1~exp1ubuntu3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libogre1.12.10t64",
            "binary_version": "1.12.10+dfsg2-6build1"
          },
          {
            "binary_name": "ogre-1.12-tools",
            "binary_version": "1.12.10+dfsg2-6build1"
          },
          {
            "binary_name": "python3-ogre-1.12",
            "binary_version": "1.12.10+dfsg2-6build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "ogre-1.12",
        "purl": "pkg:deb/ubuntu/ogre-1.12@1.12.10+dfsg2-6build1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.12.10+dfsg2-6build1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libogre1.12.10t64",
            "binary_version": "1.12.10+dfsg2-9"
          },
          {
            "binary_name": "ogre-1.12-tools",
            "binary_version": "1.12.10+dfsg2-9"
          },
          {
            "binary_name": "python3-ogre-1.12",
            "binary_version": "1.12.10+dfsg2-9"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "ogre-1.12",
        "purl": "pkg:deb/ubuntu/ogre-1.12@1.12.10+dfsg2-9?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.12.10+dfsg2-6build1",
        "1.12.10+dfsg2-7",
        "1.12.10+dfsg2-8",
        "1.12.10+dfsg2-9"
      ]
    }
  ],
  "aliases": [],
  "details": "A weakness has been identified in OGRECave Ogre up to 14.4.1. Impacted is the function STBIImageCodec::encode of the file /ogre/PlugIns/STBICodec/src/OgreSTBICodec.cpp. This manipulation causes mismatched memory management routines. The attack is restricted to local execution. The exploit has been made available to the public and could be exploited.",
  "id": "UBUNTU-CVE-2025-11015",
  "modified": "2026-05-20T15:16:01Z",
  "published": "2025-09-26T14:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-11015"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-11015"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/OGRECave/ogre/issues/3446"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/user-attachments/files/22328216/poc.zip"
    },
    {
      "type": "REPORT",
      "url": "https://vuldb.com/?ctiid.325958"
    },
    {
      "type": "REPORT",
      "url": "https://vuldb.com/?id.325958"
    },
    {
      "type": "REPORT",
      "url": "https://vuldb.com/?submit.654340"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2025-11015"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-11015 (GCVE-0-2025-11015)

FKIE_CVE-2025-11015

GHSA-JMM8-JQF2-7X8J

UBUNTU-CVE-2025-11015 (CVE-2025-11015)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour