CVE-2026-110735

Awaiting Analysis Awaiting Analysis - Queue

Heap Out-of-Bounds Write in Godot Engine

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: MITRE

Description

Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/resource_format_binary.cpp, ResourceLoaderBinary::get_unicode_string). A string length is read from the resource file into a signed 32-bit integer and compared against the destination buffer size with a signed comparison, which conditionally resizes the buffer. A negative length value skips the resize; the same value is then passed to the copy routine as an unsigned byte count, where it sign-extends to a huge value, copying file-controlled data far past the undersized heap allocation. The defect is reached when the product or an exported game loads a crafted binary resource file (.res). NOTE: the Supplier's position is that the research has identified "no security issues" because the required attacker access is outside of the current Godot Engine threat model.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110735

EUVD

EUVD-2026-101305

Affected Vendors & Products

Vendor	Product	Version / Range
godotengine	Godot	Engine 1.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-195	The product uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected value if the value of the signed primitive can not be represented using an unsigned primitive.

Attack-Flow Graph

Executive Summary

This vulnerability is a heap out-of-bounds write in Godot Engine versions up to 4.7.2. It occurs in the binary resource loader when processing a crafted .res file. A negative string length value bypasses buffer resizing and is then used as a large unsigned value during memory copying, corrupting memory beyond the allocated buffer.

Detection Guidance

This vulnerability requires loading a crafted binary resource file (.res) in Godot Engine 4.7.2 or earlier. Detection involves checking for suspicious .res files or monitoring for crashes during resource loading. No specific commands are provided in the context, but you can inspect files for unusual sizes or use debugging tools to trace memory corruption during Godot Engine execution.

Impact Analysis

The impact depends on attacker access. If an attacker controls the filesystem and provides a malicious .res file, this could crash the application or potentially allow arbitrary code execution in the context of the Godot Engine process. Exported games loading user-uploaded files may also be affected.

Compliance Impact

The vulnerability involves a heap out-of-bounds write in Godot Engine's binary resource loader, triggered by loading a crafted file. This could lead to crashes or arbitrary code execution if exploited. However, the Godot security team considers it a non-security issue because exploitation requires prior filesystem access. This stance may conflict with compliance requirements under GDPR or HIPAA, which mandate protection against memory corruption vulnerabilities that could compromise data integrity or availability.

Mitigation Strategies

Upgrade to the latest Godot Engine version if available, as the vendor may have addressed this issue. Avoid loading untrusted .res files or files from untrusted sources. Implement file validation checks before processing resources. Monitor for crashes or memory corruption during resource loading as a potential sign of exploitation.

Hi! I’m here to help you understand CVE-2026-110735. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70