CVE-2025-11015

MediumCVSS 5.3

Published: 26/09/2025(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

3th percentile - higher than 3% of all known CVEs

Summary

A weakness has been identified in Ogre up to version 14.4.1 in the STBIImageCodec::encode function of /ogre/PlugIns/STBICodec/src/OgreSTBICodec.cpp. Manipulation causes mismatched memory management routines. The attack requires local execution and the exploit is publicly available.

Risk Assessment

The vulnerability may lead to memory corruption or code execution by a local attacker. The public availability of the exploit increases the risk of exploitation.

Recommendation

Update Ogre to a version newer than 14.4.1 or apply patches. Avoid processing untrusted images in applications using Ogre.

Other vulnerabilities in Ogre

CVE-2025-11017Low
In Ogre library up to 14.4.1, the Ogre::LogManager::stream function in OgreLogManager.cpp allows manipulation of the mDefaultLog argument, resulting in a null pointer dereference. The attack requires local access, and the exploit is publicly available.

Original NVD description (English source)

A weakness has been identified in OGRECave Ogre up to 14.4.1. Impacted is the function STBIImageCodec::encode of the file /ogre/PlugIns/STBICodec/src/OgreSTBICodec.cpp. This manipulation causes mismatched memory management routines. The attack is restricted to local execution. The exploit has been made available to the public and could be exploited.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS