CVE-2025-11014: OGRECave Ogre Image OgreSTBICodec.cpp encode heap-based overflow

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-09-26 · updated 2026-10-09
Weakness: CWE-119

Description

A security flaw has been discovered in OGRECave Ogre up to 14.4.1. This issue affects the function STBIImageCodec::encode of the file /ogre/PlugIns/STBICodec/src/OgreSTBICodec.cpp of the component Image Handler. The manipulation results in heap-based buffer overflow. The attack is only possible with local access. The exploit has been released to the public and may be exploited.

Affected products

OGRECave Ogre: through 14.4.1

References

https://github.com/OGRECave/ogre/issues/3445
https://github.com/user-attachments/files/22326665/poc.zip
https://vuldb.com/?ctiid.325957
https://vuldb.com/?id.325957
https://vuldb.com/?submit.654269
https://github.com/OGRECave/ogre/issues/3445
https://github.com/user-attachments/files/22326665/poc.zip

Get alerted when CVE-2025-11014 or the next vulnerability affects your stack