Godot Engine version All versions prior to 2.1.5, all 3.0 versions prior to 3.0.6.
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-131 and the CVSS impact.
Summary
Godot Engine version All versions prior to 2.1.5, all 3.0 versions prior to 3.0.6. contains a Signed/unsigned comparison, wrong buffer size chackes, integer overflow, missing padding initialization vulnerability in (De)Serialization functions (core/io/marshalls.cpp) that can result in DoS (packet of death), possible leak of uninitialized memory. This attack appear to be exploitable via A malformed packet is received over the network by a Godot application that uses built-in serialization (e.g. game server, or game client). Could be triggered by multiplayer opponent. This vulnerability appears to have been fixed in 2.1.5, 3.0.6, master branch after commit feaf03421dda0213382b51aff07bd5a96b29487b.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:godotengine:godot:*:*:*:*:*:*:*:* | before 2.1.5; 3.0.0 to before 3.0.6 | Vulnerable | godotengine |
- cpe:2.3:a:godotengine:godot:*:*:*:*:*:*:*:* Versions before 2.1.5; 3.0.0 to before 3.0.6 Vulnerable ·godotengine
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-1000224
- 2026-10-03 Alias added: GHSA-rc36-5vc3-6jxx
- 2026-11-05 EPSS moved to the 90th–95th percentile
References
More godotengine Godot vulnerabilities
- TI-2019-07395 In Godot through 3.1, remote code execution is possible due to the deserialization policy not being applied correctly. CVSS 3.0CRITICAL 9.8
Sources
- CVE-2018-1000224 · CVE Program
- CVE-2018-1000224 · NVD
- FIRST EPSS
- GHSA-rc36-5vc3-6jxx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences