Integer Overflow Vulnerability in Godot Engine by Godot Engine Developers
CVE-2021-26825

7.8HIGH

Key Information:

Vendor

Godotengine

Status
Godot Engine
Vendor
CVE Published:
8 February 2021

What is CVE-2021-26825?

An integer overflow vulnerability in Godot Engine versions up to v3.2 can be triggered when loading specially crafted TGA image files. This issue resides in the ImageLoaderTGA::load_image() function, where improper handling of input dimensions can result in a dynamic stack buffer overflow. Exploitation of this vulnerability could lead to severe consequences, including code execution or a system crash, depending on the context of the application. The attack can be executed locally or remotely, posing a significant risk to users and applications relying on this engine.

References

https://github.com/godotengine/godot/pull/45702
x_refsource_MISC
https://github.com/godotengine/godot/pull/45702/files
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.