CVE-2026-110735
LowCVSS 2.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/resource_format_binary.cpp, ResourceLoaderBinary::get_unicode_string). A string length is read from the resource file into a signed 32-bit integer and compared against the destination buffer size with a signed comparison, which conditionally resizes the buffer. A negative length value skips the resize; the same value is then passed to the copy routine as an unsigned byte count, where it sign-extends to a huge value, copying file-controlled data far past the undersized heap allocation.
Risk Assessment
The defect is reached when the product or an exported game loads a crafted binary resource file (.res), potentially leading to code execution or crash. The Supplier's position is that the research has identified "no security issues" because the required attacker access is outside of the current Godot Engine threat model.
Recommendation
Update Godot Engine to a version later than 4.7.2 if available, and avoid loading untrusted binary resource files (.res).
Other vulnerabilities in Godot Engine
See all- CVE-2026-110736Low
Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader (core/string/optimized_translation.cpp, OptimizedTranslation::get_message). Offsets read from the hash table of a crafted .translation resource are used as indices into the bucket table without bounds validation; only a single sentinel value is rejected. A crafted file can point an index far past the allocated buffer, resulting in a crash or a string lookup returning raw bytes from elsewhere in the process heap as the translated string, disclosing process memory.
- CVE-2026-110734Low
Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR (.hdr) image decoder (modules/hdr/image_loader_hdr.cpp). The run-length decoding loop expands RLE instructions read from the file into a buffer sized from the image dimensions, without validating that an instruction's repeat/copy count fits the remaining capacity of the row buffer. A crafted .hdr file therefore writes attacker-supplied bytes past the end of the heap allocation, with the overflow length and content controlled by the file.
Original NVD description (English source)
Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/resource_format_binary.cpp, ResourceLoaderBinary::get_unicode_string). A string length is read from the resource file into a signed 32-bit integer and compared against the destination buffer size with a signed comparison, which conditionally resizes the buffer. A negative length value skips the resize; the same value is then passed to the copy routine as an unsigned byte count, where it sign-extends to a huge value, copying file-controlled data far past the undersized heap allocation. The defect is reached when the product or an exported game loads a crafted binary resource file (.res). NOTE: the Supplier's position is that the research has identified "no security issues" because the required attacker access is outside of the current Godot Engine threat model.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS