Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

Godot 4.x: heap out-of-bounds write in Radiance HDR image loader

oss-security ()2 · 2 reads
Read at seclists.org
Part of a story covered by 2 sourcesGodot 4.x: heap out-of-bounds write via negative string length in binary resource loaderMerged summary & timeline
AI summary · grok-4.7-buildSummaries by Vani AI

Godot 4.x Radiance HDR loader has an unpatched heap out-of-bounds write on untrusted images.

Tomasz Kaye reported a heap out-of-bounds write in Godot 4’s Radiance HDR image loader, ImageLoaderHDR::load_image, one of three memory-safety bugs in untrusted-file parsers disclosed on September 21, 2026. The issue was verified in the official Godot 4.7-stable build, commit 5b4e0cb0f, and earlier 4.x versions are presumed affected. The loader dates to May 2017 and was still unpatched on master, 4.7.2, 4.7.1, and 4.7 when checked on October 13, 2026.

Key facts
  • Heap out-of-bounds write is in Godot’s Radiance HDR image loader.
  • Godot 4.7-stable was verified; earlier 4.x releases are presumed affected.
  • The loader remains unpatched on master and 4.7.x as of October 13, 2026.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
godotmemory-corruptionheap-overflowhdrimage-loaderunpatched
Products
Godot

From the original article

Posted by Tomasz Kaye on Oct 14 Three memory-safety bugs in Godot 4's untrusted-file parsers were publicly disclosed on 2026-09-21 [1]. This thread covers the HDR loader bug. Affected versions: Godot 4.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.