TI-2026-74162 Aliases CVE-2026-110735 GHSA-qpjh-gxxf-v482

Heap out-of-bounds write in Godot Engine binary resource loader

LOW 12CWE-195Published 2026-10-14 · Updated 2026-10-20

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: None · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Godot Engine from 1.0.0 through 4.7.2 contains a heap out-of-bounds write in its binary resource loader. A signed string length read from a resource file is not checked for negative values, so the copy writes file-controlled data past the heap buffer (CWE-195). A local attacker needs a user to load a crafted .res file in the product or an exported game, which can corrupt memory with low integrity impact. The supplier states that the required attacker access is outside its threat model.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/resource_format_binary.cpp, ResourceLoaderBinary::get_unicode_string). A string length is read from the resource file into a signed 32-bit integer and compared against the destination buffer size with a signed comparison, which conditionally resizes the buffer. A negative length value skips the resize; the same value is then passed to the copy routine as an unsigned byte count, where it sign-extends to a huge value, copying file-controlled data far past the undersized heap allocation. The defect is reached when the product or an exported game loads a crafted binary resource file (.res). NOTE: the Supplier's position is that the research has identified "no security issues" because the required attacker access is outside of the current Godot Engine threat model.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00155 4th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
godotengine	Godot Engine	1.0.0 – 4.7.2	—	No fix listed	CNA

Godot Engine Vendorgodotengine Affected 1.0.0 – 4.7.2 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Godot Engine.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-14 Threatist record created from CVE-2026-110735
2026-10-15 Alias added: GHSA-qpjh-gxxf-v482
2026-10-15 Title updated · CNA
2026-10-15 Affected versions changed · CNA
2026-10-20 CISA SSVC decision points changed
2026-11-06 Affected versions changed · Red Hat
2026-11-06 CVSS score added · Red Hat

References

Other 2

TI-2026-74175 Out-of-bounds read in Godot Engine translation loader CVSS 3.1LOW 3.6
TI-2019-07395 In Godot through 3.1, remote code execution is possible due to the deserialization policy not being applied correctly. CVSS 3.0CRITICAL 9.8
TI-2018-15869 Godot Engine version All versions prior to 2.1.5, all 3.0 versions prior to 3.0.6. CVSS 3.0HIGH 7.5
TI-2021-08451 A stack overflow issue exists in Godot Engine up to v3.2 and is caused by improper… CVSS 3.1HIGH 7.8
TI-2021-08450 An integer overflow issue exists in Godot Engine up to v3.2 that can be triggered when… CVSS 3.1HIGH 7.8
TI-2026-74161 Heap out-of-bounds write in Godot Engine HDR image decoder CVSS 3.1LOW 2.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences