Vulnerability · Published Oct 14, 2026 · Assigned by mitre
CVE-2026-110735
Low 2.5
In plain English
A low-severity security flaw in Godot Engine from godotengine. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/resource_format_binary.cpp, ResourceLoaderBinary::get_unicode_string). A string length is read from the resource file into a signed 32-bit integer and compared against the destination buffer size with a signed comparison, which conditionally resizes the buffer. A negative length value skips the resize; the same value is then passed to the copy routine as an unsigned byte count, where it sign-extends to a huge value, copying file-controlled data far past the undersized heap allocation. The defect is reached when the product or an exported game loads a crafted binary resource file (.res). NOTE: the Supplier's position is that the research has identified "no security issues" because the required attacker access is outside of the current Godot Engine threat model.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | godot | no fix listed | DEBIAN-CVE-2026-110735 |
| Debian:13 | godot | no fix listed | DEBIAN-CVE-2026-110735 |
| Debian:14 | godot | 4.6.3+ds-3 | DEBIAN-CVE-2026-110735 |
| Debian:14 | godot3 | no fix listed | DEBIAN-CVE-2026-110735 |
| Ubuntu:26.10 | godot | no fix listed | UBUNTU-CVE-2026-110735 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| godotengine | Godot Engine | 1.0.0 – through 4.7.2 |
Weakness: CWE-195 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N