CVE-2026-110734

Awaiting Analysis Awaiting Analysis - Queue

Heap Out-of-Bounds Write in Godot Engine HDR Decoder

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: MITRE

Description

Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR (.hdr) image decoder (modules/hdr/image_loader_hdr.cpp). The run-length decoding loop expands RLE instructions read from the file into a buffer sized from the image dimensions, without validating that an instruction's repeat/copy count fits the remaining capacity of the row buffer. A crafted .hdr file therefore writes attacker-supplied bytes past the end of the heap allocation, with the overflow length and content controlled by the file. The defect is reached automatically when the product imports a crafted .hdr (e.g., when opening a project containing one), and at runtime in exported projects that load untrusted .hdr images. NOTE: the Supplier's position is that the research has identified "no security issues" because the required attacker access is outside of the current Godot Engine threat model.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110734

EUVD

EUVD-2026-101301

Affected Vendors & Products

Vendor	Product	Version / Range
godotengine	Godot	Engine 3.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is a heap out-of-bounds write in Godot Engine's Radiance HDR (.hdr) image decoder. When processing a crafted .hdr file, the decoder fails to validate that a run-length encoding instruction's repeat count fits within the allocated buffer. This allows attacker-controlled data to be written past the end of the heap allocation during automatic asset import or runtime loading of untrusted files.

Detection Guidance

This vulnerability can be detected by monitoring for crashes or unexpected behavior when processing HDR image files in Godot Engine versions up to 4.7.2. Check for heap corruption errors or out-of-bounds write warnings in logs when importing .hdr files. Use tools like AddressSanitizer (ASan) during compilation to detect memory safety issues.

Impact Analysis

An attacker could exploit this to crash the application or potentially execute arbitrary code by providing a specially crafted .hdr file. This is most relevant for projects that import untrusted HDR images or exported games that load user-uploaded files. The impact depends on the privileges of the Godot process and whether the crafted file is processed automatically or manually.

Compliance Impact

This vulnerability involves a heap out-of-bounds write in Godot Engine's HDR image decoder, allowing arbitrary memory corruption when processing crafted .hdr files. While it could lead to crashes or code execution in some contexts, the Godot security team considers it a non-security issue because exploitation requires prior filesystem access. This limits direct impact on compliance with standards like GDPR or HIPAA, which typically focus on unauthorized data access or processing. However, if exploited in exported games handling untrusted files (e.g., mods), it could theoretically enable data exfiltration or integrity breaches, indirectly affecting compliance.

Mitigation Strategies

Upgrade to a patched version of Godot Engine if available. Avoid importing untrusted HDR files. Use file validation and sandboxing to restrict file access. Monitor for crashes or memory corruption when processing images.

Hi! I’m here to help you understand CVE-2026-110734. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70