Heap Out-of-Bounds Write in Godot Engine Affecting Radiance HDR Image Decoder

CVE-2026-110734

What is CVE-2026-110734?

The Godot Engine prior to 4.7.2 has a vulnerability in the Radiance HDR image decoder that allows for a potential heap out-of-bounds write. This occurs during the processing of run-length encoded instructions from .hdr files, where the size of the buffer is derived from the image dimensions without appropriate validation of the length of the data being written. When a specially crafted .hdr file is imported or used in a project, it could result in writing beyond the intended memory bounds, threatening application stability and security. The supplier's current assessment suggests that this vulnerability is outside their defined threat model, as attacker exploitation would require specific, untrusted HDR files.

References