Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

Godot 4.x: heap out-of-bounds write via negative string length in binary resource loader

oss-security ()2 · 1 read
Read at seclists.org
Part of a story covered by 2 sourcesGodot 4.x: heap out-of-bounds write via negative string length in binary resource loaderMerged summary & timeline
AI summary · grok-4.7-buildSummaries by Vani AI

Godot 4.x binary resource loader has an unpatched heap out-of-bounds write via negative string length.

Tomasz Kaye described a heap out-of-bounds write in Godot 4’s binary resource loader caused by a negative string length, part of three memory-safety bugs disclosed on September 21, 2026. The bug was verified in the official Godot 4.7-stable release, with earlier versions presumed affected. The parser has been present since Godot was open-sourced in 2014 and was still unpatched on master, 4.7.2, 4.7.1, and 4.7 as of October 13, 2026.

Key facts
  • A negative string length triggers a heap out-of-bounds write.
  • The binary resource parser has existed since Godot was open-sourced in 2014.
  • Godot 4.7-stable is verified affected and remained unpatched on October 13, 2026.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
godotmemory-corruptionheap-overflowbinary-resourceuntrusted-fileunpatched
Products
Godot

From the original article

Posted by Tomasz Kaye on Oct 14 Three memory-safety bugs in Godot 4's untrusted-file parsers were publicly disclosed on 2026-09-21 [1]. This thread covers the binary resource loader bug. Affected versions: Godot 4.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.