godotengine Godot Engine up to 4.7.2 Radiance HDR Image Decoder image_loader_hdr.cpp out-of-bounds write ⚔ [Disputed]

Summaryinfo

A vulnerability was found in godotengine Godot Engine up to 4.7.2. It has been classified as critical. This impacts an unknown function of the file modules/hdr/image_loader_hdr.cpp of the component Radiance HDR Image Decoder. Performing a manipulation results in out-of-bounds write. This vulnerability was named CVE-2026-110734. The attack may be initiated remotely. There is no available exploit. There is ongoing doubt regarding the real existence of this vulnerability.

Detailsinfo

A vulnerability, which was classified as critical, was found in godotengine Godot Engine up to 4.7.2. This affects an unknown code block of the file modules/hdr/image_loader_hdr.cpp of the component Radiance HDR Image Decoder. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. CWE is classifying the issue as CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR (.hdr) image decoder (modules/hdr/image_loader_hdr.cpp). The run-length decoding loop expands RLE instructions read from the file into a buffer sized from the image dimensions, without validating that an instruction's repeat/copy count fits the remaining capacity of the row buffer. A crafted .hdr file therefore writes attacker-supplied bytes past the end of the heap allocation, with the overflow length and content controlled by the file. The defect is reached automatically when the product imports a crafted .hdr (e.g., when opening a project containing one), and at runtime in exported projects that load untrusted .hdr images. NOTE: the Supplier's position is that the research has identified "no security issues" because the required attacker access is outside of the current Godot Engine threat model.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-110734 since 10/14/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/14/2026).

The real existence of this vulnerability is still doubted at the moment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• godotengine

Name

• Godot Engine

Version

• 4.7.0
• 4.7.1
• 4.7.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion