CVE-2026-110734 in Godot Engine
Summary
by MITRE • 10/14/2026
Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR (.hdr) image decoder (modules/hdr/image_loader_hdr.cpp). The run-length decoding loop expands RLE instructions read from the file into a buffer sized from the image dimensions, without validating that an instruction's repeat/copy count fits the remaining capacity of the row buffer. A crafted .hdr file therefore writes attacker-supplied bytes past the end of the heap allocation, with the overflow length and content controlled by the file. The defect is reached automatically when the product imports a crafted .hdr (e.g., when opening a project containing one), and at runtime in exported projects that load untrusted .hdr images. NOTE: the Supplier's position is that the research has identified "no security issues" because the required attacker access is outside of the current Godot Engine threat model.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified within the Godot Engine, specifically affecting versions up to 4.7.2, constitutes a critical heap-based buffer overflow located in the Radiance HDR image decoder module. This flaw resides in the file modules/hdr/image_loader_hdr.cpp and is triggered during the processing of Run-Length Encoded (RLE) data found within .hdr files. The core technical defect arises from an insufficient validation check prior to memory allocation operations. When the engine parses a crafted .hdr file, it calculates buffer sizes based on image dimensions but fails to verify that the repeat or copy counts specified in the RLE instructions are compatible with the remaining capacity of the row buffer. Consequently, when the decoding loop expands these instructions into the allocated heap memory, it writes data beyond the bounds of the originally allocated block. This allows an attacker who controls the content and length of the overflow to write arbitrary bytes past the end of a heap allocation, potentially leading to memory corruption that can be exploited for remote code execution or denial of service conditions depending on the specific runtime environment and exploitation techniques employed.
From a threat modeling perspective, this vulnerability is classified under CWE-122: Heap-based Buffer Overflow, which describes writing data beyond the bounds of a buffer allocated on the heap. The operational impact is significant because the flaw can be triggered automatically when the engine imports or loads an image file, such as when opening a project that contains a malicious .hdr texture or during runtime in exported applications that load untrusted assets. Although the vendor has stated that they do not consider this a security issue due to their current threat model which may exclude scenarios involving loading of arbitrary external files by end-users without sandboxing, the technical reality remains that any application utilizing Godot Engine as its rendering backend is susceptible if it processes user-supplied HDR images. The ability to control both the overflow length and content elevates this from a simple crash vulnerability to one with potential for privilege escalation or full system compromise in contexts where memory layout can be manipulated further through heap grooming techniques.
In terms of industry-standard attack frameworks, this vulnerability aligns with ATT&CK technique T1203: Exploitation for Client Execution, as it relies on the victim opening a malicious file to trigger the exploit chain. It also relates to CWE-787: Out-of-bounds Write in general memory safety contexts. The lack of bounds checking during the RLE decoding process represents a fundamental failure in input validation and boundary checks, which are primary defenses against buffer overflow attacks. Mitigation strategies must focus on rigorous input sanitization within the image loader module. Developers should implement strict length verification to ensure that the number of pixels or bytes indicated by an RLE instruction does not exceed the remaining space in the target row buffer before performing any write operations. Additionally, integrating memory-safe programming practices and utilizing static analysis tools capable of detecting out-of-bounds writes can help identify similar flaws across other image decoders within the engine. Until a patched version is deployed, users should exercise extreme caution when loading HDR images from untrusted sources, and application developers should consider implementing additional sandboxing or validation layers to mitigate the risk associated with this heap corruption vulnerability.