Godot 4.0.0–4.7.2 remote crash via spawn-packet overflow
Original title: Godot 4.x: remote client crash via multiplayer spawn packet sync_len overflow
A bounds check in SceneReplicationInterface::on_spawn_receive fails on sync_len; no patch version is named.
Tomasz Kaye disclosed a remote denial-of-service flaw in Godot 4.x multiplayer on October 27. Godot 4.0.0 through 4.7.2 and current master are affected; the vulnerable check was introduced in commit 32a62af648 on October 3, 2022. It was runtime-confirmed on the official 4.7-stable Windows binary. The issue is a spawn-packet bounds check on sync_len in SceneReplicationInterface::on_spawn_receive.
Unconfirmed: No CVE or fixed version is stated, and real-world attacks are not described.
- Affects Godot 4.0.0 through 4.7.2 and current master.
- Vulnerable check added in commit 32a62af648 on October 3, 2022.
- Confirmed on the official 4.7-stable Windows binary.
- Location cited as scene_replication_interface.cpp line 586.
Impact: Remote client crash via a spawn-packet overflow
| Product | Affected |
|---|---|
| Godot | 4.0.0 through 4.7.2 and current master |
From the original article
Posted by Tomasz Kaye on Oct 27 A remote denial-of-service vulnerability in Godot 4. x multiplayer was publicly disclosed on 2026-10-27 [1]. Affected versions: Godot 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.