{"id":"CVE-2026-110734","details":"Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR (.hdr) image decoder (modules/hdr/image_loader_hdr.cpp). The run-length decoding loop expands RLE instructions read from the file into a buffer sized from the image dimensions, without validating that an instruction's repeat/copy count fits the remaining capacity of the row buffer. A crafted .hdr file therefore writes attacker-supplied bytes past the end of the heap allocation, with the overflow length and content controlled by the file. The defect is reached automatically when the product imports a crafted .hdr (e.g., when opening a project containing one), and at runtime in exported projects that load untrusted .hdr images. NOTE: the Supplier's position is that the research has identified \"no security issues\" because the required attacker access is outside of the current Godot Engine threat model.","modified":"2026-10-15T02:47:56.560507850Z","published":"2026-10-14T15:36:08.839Z","database_specific":{"cna_assigner":"mitre","cwe_ids":["CWE-787"],"isDisputed":true,"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110734.json"},"references":[{"type":"WEB","url":"https://axeghost.offprint.app/a/3mvs6zo4blo23-three-memory-safety-bugs-in-godots-untrusted-file-parsers"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110734.json"},{"type":"PACKAGE","url":"https://github.com/godotengine/godot"},{"type":"REPORT","url":"https://github.com/godotengine/godot/issues/123608"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110734"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/godotengine/godot","events":[{"introduced":"0"},{"last_affected":"ed1daf0bf001b61586d9930840f2f1394092c079"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"3.0.0"},{"last_affected":"4.7.2"}]}}],"versions":["4.7.2-stable","4.7.1-stable","4.7-stable","4.6-stable","4.5-stable","4.3-stable","4.4-stable","4.2-stable","4.1-stable","4.0-stable","3.2-stable","3.1-stable","3.0-stable","2.0-stable","2.0-rc1","2.0-beta","1.1-rc3","1.1-rc2","1.1-rc1","1.0-rc2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110734.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"}]}