Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

Godot 4.x merges fixes for three heap out-of-bounds loader bugs

1 source · 3 articlesFirst reported Updated ()1 · 1 read
What's new

October 23: oss-security posts confirm the three loader fixes are merged upstream; they add no release version, patch date, or exploitation report.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Godot 4.x has merged upstream fixes for three heap out-of-bounds bugs; only the HDR loader issue is tied to CVE-2026-110734.

Three oss-security follow-ups on 23 October 2026 report that Godot 4.x merged separate upstream fixes for heap memory-safety bugs. Pull request 124697 fixes a heap out-of-bounds write in the Radiance HDR image loader, cited as CVE-2026-110734, by rejecting non-positive and oversized image dimensions and limiting each RLE run and dump to the remaining scanline width. Pull request 124699 fixes a heap out-of-bounds write in the binary resource loader triggered by a negative string length, rejecting negative lengths and lengths past the remaining file size in get_unicode_string and get_ustring, and returning early on a zero length in get_ustring. Pull request 124701 fixes a heap out-of-bounds read in OptimizedTranslation message lookup with helpers that validate bucket and string offsets for get_message and get_translated_message_list, plus input bounds checks. None of the notes report exploitation, and only the HDR issue is cited with a CVE.

Key facts
  • Pull request 124697 fixes the Radiance HDR heap out-of-bounds write, cited as CVE-2026-110734.
  • The HDR fix rejects bad dimensions and limits RLE runs to the remaining scanline width.
  • Pull request 124699 rejects negative or oversized string lengths in the binary resource loader.
  • Zero-length strings return early in get_ustring under pull request 124699.
  • Pull request 124701 validates bucket and string offsets used by OptimizedTranslation message lookup.
  • No exploitation is stated for any of the three bugs.
Analyze CVE-2026-110734 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 23, 2026HDR loader fix merged in pull request 124697. · oss-security
  2. Oct 23, 2026Binary resource loader string-length fix merged in pull request 124699. · oss-security
  3. Oct 23, 2026OptimizedTranslation lookup fix merged in pull request 124701. · oss-security

What each outlet adds

beyond the shared facts
  • oss-securityThree distinct merged pull requests, with CVE-2026-110734 cited only for the HDR bug.
CVEs
CVE-2026-110734
Vendors
Godot Engine
Products
Godot

Coverage

oldest first · one row per article · UTC
  1. · 2d ago oss-securityFirst report

    Godot 4.x Radiance HDR loader heap write fix merged

    Pull request 124697 rejects bad image sizes and bounds RLE runs; its body cites CVE-2026-110734.

  2. · 1d ago oss-security

    Godot 4.x binary resource loader heap write fix merged

    Pull request 124699 rejects negative or oversized string lengths in the binary resource loader's string readers.

  3. · 1d ago oss-security

    Godot 4.x translation lookup heap over-read fix merged

    Upstream pull request 124701 checks bucket and string offsets used by message lookup and the translated message list.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-110734
Heap out-of-bounds write in Godot Engine HDR loader
2.5—