Re: Godot 4.x: heap out-of-bounds write in Radiance HDR image loader
Godot 4.x Radiance HDR loader flaw CVE-2026-110734 is disputed and scored CVSS 2.5.
A follow-up on the oss-security list says CVE-2026-110734 was assigned for a heap out-of-bounds write in the Godot 4.x Radiance HDR image loader. MITRE tagged the record disputed and included the supplier's position that there are no security issues. The published CVSS 3.1 score is 2.5 (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N). The reporter filed a reconsideration request with MITRE's CVE Numbering Authority of Last Resort. No exploitation is reported.
- CVE-2026-110734 covers a heap out-of-bounds write in Godot 4.x's Radiance HDR loader.
- MITRE marked the record disputed and quoted the supplier saying there are no security issues.
- Published CVSS 3.1 is 2.5: local, high complexity, user interaction, low integrity only.
- The reporter asked MITRE's CNA of last resort to reconsider the record.
Coverage
oldest first · one row per article · UTC- · 10d ago
oss-securityFirst report
Re: Godot 4.x: heap out-of-bounds read in OptimizedTranslation message lookup
Disputed CVE-2026-110736 covers a Godot 4.x heap out-of-bounds read scored CVSS 3.6.
- · 10d ago
Re: Godot 4.x: heap out-of-bounds write via negative string length in binary resource loader
Disputed CVE-2026-110735 covers a Godot 4.x heap out-of-bounds write scored CVSS 2.5.
- · 10d ago
Re: Godot 4.x: heap out-of-bounds write in Radiance HDR image loader
Godot 4.x Radiance HDR loader flaw CVE-2026-110734 is disputed and scored CVSS 2.5.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-110734+1 related CVE | Heap out-of-bounds write in Godot Engine HDR loader | 2.5 | — | ||
| CVE-2026-110736 | Heap out-of-bounds read in Godot Engine translation loader | 3.6 | — |