Re: Godot 4.x: heap out-of-bounds write via negative string length in binary resource loader
Disputed CVE-2026-110735 covers a Godot 4.x heap out-of-bounds write scored CVSS 2.5.
28
Vulnerability3 · 2 reads
CVE-2026-110735
Heap out-of-bounds write in Godot Engine resource loader
- CVSS 3.1
- 2.5 low
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (ResourceLoaderBinary::get_unicode_string in core/io/resource_format_binary.cpp), tracked as CWE-195. A string length from a .res file is stored in a signed 32-bit integer; a negative value fails a signed size check and skips buffer growth, then is used as an unsigned copy length that becomes huge and writes file-controlled data past the heap allocation. The flaw is reached when the editor or an exported game loads a crafted binary resource, which published CVSS 3.1 scores as local, high complexity, user interaction required, and low integrity impact only (2.5). The supplier says this is not a security issue because the required access is outside the engine threat model. It is not on the CISA KEV list and no public proof-of-concept is known.
What to do: Do not open untrusted Godot binary resource files (.res) in the editor or in exported games, and treat any externally supplied .res as untrusted input. No fixed release is identified in this CVE data, and the project currently states the issue is outside its threat model, so track Godot security advisories and upgrade if a release after 4.7.2 addresses the loader.
| Product | Affected |
|---|---|
| Godot Engine | through 4.7.2 |
Estimated exposure
largehundreds of thousands or more Godot installs and exported games (order of magnitude) — Order-of-magnitude estimate from Godot’s wide use as a free game engine with a large public download base and many shipped games; no install census is in the CVE data, and practical exposure is narrower because a victim must locally open a…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/resource_format_binary.cpp, ResourceLoaderBinary::get_unicode_string). A string length is read from the resource file into a signed 32-bit integer and compared against the destination buffer size with a signed comparison, which conditionally resizes the buffer. A negative length value skips the resize; the same value is then passed to the copy routine as an unsigned byte count, where it sign-extends to a huge value, copying file-controlled data far past the undersized heap allocation. The defect is reached when the product or an exported game loads a crafted binary resource file (.res). NOTE: the Supplier's position is that the research has identified "no security issues" because the required attacker access is outside of the current Godot Engine threat model.
- Weakness
- CWE-195
- Vector
- CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N