CVE-2025-11017

LowCVSS 3.3

Published: 26/09/2025(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

In Ogre library up to 14.4.1, the Ogre::LogManager::stream function in OgreLogManager.cpp allows manipulation of the mDefaultLog argument, resulting in a null pointer dereference. The attack requires local access, and the exploit is publicly available.

Risk Assessment

A local attacker could cause an application crash (denial of service) by supplying crafted data to the logging function. Since the exploit is public, the risk of exploitation is high in environments where users have local access to the process.

Recommendation

Upgrade Ogre to a version later than 14.4.1 if a fix is available, or restrict local access to applications using Ogre. Monitor official sources for a patch.

Other vulnerabilities in Ogre

CVE-2025-11015Medium
A weakness has been identified in Ogre up to version 14.4.1 in the STBIImageCodec::encode function of /ogre/PlugIns/STBICodec/src/OgreSTBICodec.cpp. Manipulation causes mismatched memory management routines. The attack requires local execution and the exploit is publicly available.

Original NVD description (English source)

A vulnerability was detected in OGRECave Ogre up to 14.4.1. The impacted element is the function Ogre::LogManager::stream of the file /ogre/OgreMain/src/OgreLogManager.cpp. Performing manipulation of the argument mDefaultLog results in null pointer dereference. The attack must be initiated from a local position. The exploit is now public and may be used.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS