{"id":"CVE-2026-110735","details":"Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/resource_format_binary.cpp, ResourceLoaderBinary::get_unicode_string). A string length is read from the resource file into a signed 32-bit integer and compared against the destination buffer size with a signed comparison, which conditionally resizes the buffer. A negative length value skips the resize; the same value is then passed to the copy routine as an unsigned byte count, where it sign-extends to a huge value, copying file-controlled data far past the undersized heap allocation. The defect is reached when the product or an exported game loads a crafted binary resource file (.res). NOTE: the Supplier's position is that the research has identified \"no security issues\" because the required attacker access is outside of the current Godot Engine threat model.","modified":"2026-10-15T10:47:30.175646129Z","published":"2026-10-14T15:41:50.110Z","database_specific":{"isDisputed":true,"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110735.json","cna_assigner":"mitre","cwe_ids":["CWE-195"]},"references":[{"type":"WEB","url":"https://axeghost.offprint.app/a/3mvs6zo4blo23-three-memory-safety-bugs-in-godots-untrusted-file-parsers"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110735.json"},{"type":"PACKAGE","url":"https://github.com/godotengine/godot"},{"type":"REPORT","url":"https://github.com/godotengine/godot/issues/123608"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110735"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/godotengine/godot","events":[{"introduced":"0"},{"last_affected":"ed1daf0bf001b61586d9930840f2f1394092c079"}],"database_specific":{"extracted_events":[{"introduced":"1.0.0"},{"last_affected":"4.7.2"}],"source":"AFFECTED_FIELD"}}],"versions":["4.7.2-stable","4.7.1-stable","4.7-stable","4.6-stable","4.5-stable","4.3-stable","4.4-stable","4.2-stable","4.1-stable","4.0-stable","3.2-stable","3.1-stable","3.0-stable","2.0-stable","2.0-rc1","2.0-beta","1.1-rc3","1.1-rc2","1.1-rc1","1.0-rc2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110735.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"}]}