Read the docs
TI-2026-74161 Aliases CVE-2026-110734GHSA-mcg2-p5jm-qfx6

Heap out-of-bounds write in Godot Engine HDR image decoder

Priority LOW 12CWE-787Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Godot Engine from 3.0.0 through 4.7.2 contains a heap out-of-bounds write in its Radiance HDR (.hdr) image decoder. The run-length decoding loop does not check that a repeat or copy count fits the remaining row buffer, so a crafted file writes attacker-supplied bytes past the end of the heap allocation (CWE-787). The flaw is triggered when a user opens a crafted .hdr file, for example in a project that contains one, or when an exported project loads an untrusted .hdr image.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR (.hdr) image decoder (modules/hdr/image_loader_hdr.cpp). The run-length decoding loop expands RLE instructions read from the file into a buffer sized from the image dimensions, without validating that an instruction's repeat/copy count fits the remaining capacity of the row buffer. A crafted .hdr file therefore writes attacker-supplied bytes past the end of the heap allocation, with the overflow length and content controlled by the file. The defect is reached automatically when the product imports a crafted .hdr (e.g., when opening a project containing one), and at runtime in exported projects that load untrusted .hdr images. NOTE: the Supplier's position is that the research has identified "no security issues" because the required attacker access is outside of the current Godot Engine threat model.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00156 4th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
godotengineGodot Engine3.0.0 – 4.7.2—No fix listedCNA
  • Godot Engine Vendorgodotengine Affected 3.0.0 – 4.7.2 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Godot Engine.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-110734
  2. 2026-10-15 Alias added: GHSA-mcg2-p5jm-qfx6
  3. 2026-10-15 CISA SSVC decision points changed
  4. 2026-11-06 Affected versions changed · Red Hat
  5. 2026-11-06 CVSS score added · Red Hat

References

Other 2

  • TI-2026-74175 Out-of-bounds read in Godot Engine translation loader CVSS 3.1LOW 3.6
  • TI-2019-07395 In Godot through 3.1, remote code execution is possible due to the deserialization policy not being applied correctly. CVSS 3.0CRITICAL 9.8
  • TI-2018-15869 Godot Engine version All versions prior to 2.1.5, all 3.0 versions prior to 3.0.6. CVSS 3.0HIGH 7.5
  • TI-2021-08451 A stack overflow issue exists in Godot Engine up to v3.2 and is caused by improper… CVSS 3.1HIGH 7.8
  • TI-2021-08450 An integer overflow issue exists in Godot Engine up to v3.2 that can be triggered when… CVSS 3.1HIGH 7.8
  • TI-2026-74162 Heap out-of-bounds write in Godot Engine binary resource loader CVSS 3.1LOW 2.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences