Heap Out-of-Bounds Write in Godot Engine by Godot Engine

CVE-2026-110735

What is CVE-2026-110735?

A vulnerability exists within the Godot Engine, where a heap out-of-bounds write can occur during the loading of crafted binary resource files. The issue arises from an improper handling of string lengths, which can be read into a signed integer and negatively compared against the buffer size. This oversight allows a negative length to bypass necessary buffer resizing, consequently leading to a condition where file-controlled data is copied beyond the confines of the allocated heap space. It is important to note that while the Supplier maintains that this flaw lies outside their current threat model due to specific access requirements, the potential for exploitation remains concerning.

References