Godot 4.x Radiance HDR loader heap write fix merged
Original title: Re: Godot 4.x: heap out-of-bounds write in Radiance HDR image loader
Pull request 124697 rejects bad image sizes and bounds RLE runs; its body cites CVE-2026-110734.
Tomasz Kaye wrote on October 23 that the fix for a heap out-of-bounds write in Godot 4.x's Radiance HDR image loader has been merged upstream. Pull request 124697 rejects non-positive and oversized image dimensions and limits each RLE run and dump to the remaining scanline width. The pull request body cites CVE-2026-110734; the snippet ends while describing the vendor's statement.
Unconfirmed: The note is cut off after citing the vendor, so the vendor statement and exploitation status are incomplete.
- The merged change is pull request 124697.
- The loader checks dimensions and remaining scanline width.
- The pull request body cites CVE-2026-110734.
Impact: Heap out-of-bounds write while loading a Radiance HDR image
| Product | Affected |
|---|---|
| Godot Engine Godot | 4.x |
- 1.Apply the upstream fix merged in pull request 124697.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-110734 | Heap out-of-bounds write in Godot Engine HDR loader | 2.5 | — |
From the original article
Posted by Tomasz Kaye on Oct 23 Follow-up: the fix for this issue has been merged upstream. https://github. com/godotengine/godot/pull/124697 The patch rejects non-positive and oversized image dimensions and bounds each RLE run and dump against the remaining scanline width.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.