CVE-2026-110734

Godot Engine through 4.7.2 has a heap out-of-bounds write (CWE-787) in its Radiance HDR (.hdr) image decoder in modules/hdr/image_loader_hdr.cpp. The run-length decoding loop expands RLE instructions from the file into a buffer sized from the image dimensions without checking that a repeat or copy count fits the remaining row capacity, so a crafted .hdr can write attacker-controlled bytes past the end of the heap allocation. The flaw is reached automatically when the editor imports a project that contains such a file, and at runtime in exported projects that load untrusted .hdr images. Impact in the published scoring is limited to low integrity with local access and user interaction (CVSS 3.1 base 2.5); the supplier states it sees no security issue because the required access falls outside the current Godot threat model. There is no known public proof of concept and it is not listed in CISA KEV.

What to do: Do not import projects or load Radiance .hdr images from untrusted sources in the Godot editor or in exported projects, and restrict runtime image loading to trusted assets. No fixed version is identified in the advisory data (affected through 4.7.2) and the supplier currently treats this as outside its threat model, so track upstream Godot security updates and apply a patched release when one is published.