godotengine Godot Engine up to 4.7.2 Binary Resource Loader resource_format_binary.cpp get_unicode_string buffer overflow ⚔ [Disputed]

Summaryinfo

A vulnerability categorized as problematic has been discovered in godotengine Godot Engine up to 4.7.2. The affected element is the function ResourceLoaderBinary::get_unicode_string of the file core/io/resource_format_binary.cpp of the component Binary Resource Loader. Such manipulation leads to buffer overflow. This vulnerability is listed as CVE-2026-110735. The attack must be carried out locally. There is no available exploit. The actual existence of this vulnerability is currently in question.

Detailsinfo

A vulnerability was found in godotengine Godot Engine up to 4.7.2 and classified as problematic. Affected by this issue is the function ResourceLoaderBinary::get_unicode_string of the file core/io/resource_format_binary.cpp of the component Binary Resource Loader. The manipulation with an unknown input leads to a buffer overflow vulnerability. Using CWE to declare the problem leads to CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. Impacted is integrity. CVE summarizes:

Godot Engine through 4.7.2 has a heap out-of-bounds write exists in the binary resource loader (core/io/resource_format_binary.cpp, ResourceLoaderBinary::get_unicode_string). A string length is read from the resource file into a signed 32-bit integer and compared against the destination buffer size with a signed comparison, which conditionally resizes the buffer. A negative length value skips the resize; the same value is then passed to the copy routine as an unsigned byte count, where it sign-extends to a huge value, copying file-controlled data far past the undersized heap allocation. The defect is reached when the product or an exported game loads a crafted binary resource file (.res). NOTE: the Supplier's position is that the research has identified "no security issues" because the required attacker access is outside of the current Godot Engine threat model.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-110735 since 10/14/2026. The exploitation is known to be easy. The attack needs to be approached locally. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

The real existence of this vulnerability is still doubted at the moment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• godotengine

Name

• Godot Engine

Version

• 4.7.0
• 4.7.1
• 4.7.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion