Godot 4.x: heap out-of-bounds write via negative string length in binary resource loader
Merged summary · from the lead articleSummaries by Vani AI
Godot 4.x binary resource loader has an unpatched heap out-of-bounds write via negative string length.
Tomasz Kaye described a heap out-of-bounds write in Godot 4’s binary resource loader caused by a negative string length, part of three memory-safety bugs disclosed on September 21, 2026. The bug was verified in the official Godot 4.7-stable release, with earlier versions presumed affected. The parser has been present since Godot was open-sourced in 2014 and was still unpatched on master, 4.7.2, 4.7.1, and 4.7 as of October 13, 2026.
Key facts
- A negative string length triggers a heap out-of-bounds write.
- The binary resource parser has existed since Godot was open-sourced in 2014.
- Godot 4.7-stable is verified affected and remained unpatched on October 13, 2026.
Coverage
oldest first · one row per article · UTC- · 11d ago
oss-securityFirst report
Godot 4.x: heap out-of-bounds write via negative string length in binary resource loader
Godot 4.x binary resource loader has an unpatched heap out-of-bounds write via negative string length.
- · 11d ago
Godot 4.x: heap out-of-bounds write in Radiance HDR image loader
Godot 4.x Radiance HDR loader has an unpatched heap out-of-bounds write on untrusted images.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-110734+1 related CVE | Heap out-of-bounds write in Godot Engine HDR loader | 2.5 | — | ||
| CVE-2026-110736 | Heap out-of-bounds read in Godot Engine translation loader | 3.6 | — |