Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitylow

Re: Godot 4.x: heap out-of-bounds write via negative string length in binary resource loader

oss-security ()1 · 1 read
Read at seclists.org
Part of a story covered by 3 sourcesRe: Godot 4.x: heap out-of-bounds write in Radiance HDR image loaderMerged summary & timeline
AI summary · grok-4.7-buildSummaries by Vani AI

Disputed CVE-2026-110735 covers a Godot 4.x heap out-of-bounds write scored CVSS 2.5.

A follow-up on oss-security says CVE-2026-110735 was assigned for a heap out-of-bounds write in Godot 4.x's binary resource loader, triggered by a negative string length. The CVE record is disputed and quotes the supplier saying there are no security issues. MITRE scored it CVSS 3.1 2.5 (local, high complexity, user interaction, low integrity impact). The reporter filed a reconsideration request with MITRE's CNA of Last Resort.

Key facts
  • CVE-2026-110735 covers a heap out-of-bounds write in Godot 4.x.
  • The flaw is in the binary resource loader via a negative string length.
  • MITRE scored it CVSS 2.5 and tagged the record disputed.
  • The reporter asked CNA-LR to reconsider the supplier's no-security-issue position.
Analyze CVE-2026-110735 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-110735
Tags
godotcve-2026-110735heap-overflowdisputed-cvegame-engine
Vendors
Godot
Products
Godot
Organizations
MITRE

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-110735
Heap out-of-bounds write in Godot Engine resource loader
2.5—

From the original article

Posted by Tomasz Kaye on Oct 15 Follow-up: a CVE identifier has been assigned for this issue. https://www. cve.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.