Hi,
The following vulnerabilities were published for godot.
CVE-2026-110734[0]:
| Godot Engine through 4.7.2 has a heap out-of-bounds write in the
| Radiance HDR (.hdr) image decoder
| (modules/hdr/image_loader_hdr.cpp). The run-length decoding loop
| expands RLE instructions read from the file into a buffer sized from
| the image dimensions, without validating that an instruction's
| repeat/copy count fits the remaining capacity of the row buffer. A
| crafted .hdr file therefore writes attacker-supplied bytes past the
| end of the heap allocation, with the overflow length and content
| controlled by the file. The defect is reached automatically when the
| product imports a crafted .hdr (e.g., when opening a project
| containing one), and at runtime in exported projects that load
| untrusted .hdr images. NOTE: the Supplier's position is that the
| research has identified "no security issues" because the required
| attacker access is outside of the current Godot Engine threat model.
CVE-2026-110735[1]:
| Godot Engine through 4.7.2 has a heap out-of-bounds write in the
| binary resource loader (core/io/resource_format_binary.cpp,
| ResourceLoaderBinary::get_unicode_string). A string length is read
| from the resource file into a signed 32-bit integer and compared
| against the destination buffer size with a signed comparison, which
| conditionally resizes the buffer. A negative length value skips the
| resize; the same value is then passed to the copy routine as an
| unsigned byte count, where it sign-extends to a huge value, copying
| file-controlled data far past the undersized heap allocation. The
| defect is reached when the product or an exported game loads a
| crafted binary resource file (.res). NOTE: the Supplier's position
| is that the research has identified "no security issues" because the
| required attacker access is outside of the current Godot Engine
| threat model.
CVE-2026-110736[2]:
| Godot Engine through 4.7.2 has an out-of-bounds read in the
| optimized translation loader (core/string/optimized_translation.cpp,
| OptimizedTranslation::get_message). Offsets read from the hash table
| of a crafted .translation resource are used as indices into the
| bucket table without bounds validation; only a single sentinel value
| is rejected. A crafted file can point an index far past the
| allocated buffer. Depending on the values, the result is a crash, or
| a string lookup (tr()) returns raw bytes from elsewhere in the
| process heap as the translated string, disclosing process memory.
| The defect is reached when the product or an exported game loads and
| performs lookups in a crafted translation file. NOTE: the Supplier's
| position is that the research has identified "no security issues"
| because the required attacker access is outside of the current Godot
| Engine threat model.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-110734
https://www.cve.org/CVERecord?id=CVE-2026-110734
https://github.com/godotengine/godot/pull/124697
[1] https://security-tracker.debian.org/tracker/CVE-2026-110735
https://www.cve.org/CVERecord?id=CVE-2026-110735
https://github.com/godotengine/godot/pull/124699
[2] https://security-tracker.debian.org/tracker/CVE-2026-110736
https://www.cve.org/CVERecord?id=CVE-2026-110736
https://github.com/godotengine/godot/pull/124701
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore