CVE-2026-110735

Full vulnerability record from the local CVENow database.

Description

Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/resource_format_binary.cpp, ResourceLoaderBinary::get_unicode_string). A string length is read from the resource file into a signed 32-bit integer and compared against the destination buffer size with a signed comparison, which conditionally resizes the buffer. A negative length value skips the resize; the same value is then passed to the copy routine as an unsigned byte count, where it sign-extends to a huge value, copying file-controlled data far past the undersized heap allocation. The defect is reached when the product or an exported game loads a crafted binary resource file (.res). NOTE: the Supplier's position is that the research has identified "no security issues" because the required attacker access is outside of the current Godot Engine threat model.

Severity

LOW

CVSS score

2.5 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-10-14 16:17:44.467000

Last modified

2026-10-20 02:17:10.757000

View original CVE JSON

{
  "id": "CVE-2026-110735",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-14T16:17:44.467",
  "lastModified": "2026-10-20T02:17:10.757",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [
    {
      "sourceIdentifier": "[email protected]",
      "tags": [
        "disputed"
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/resource_format_binary.cpp, ResourceLoaderBinary::get_unicode_string). A string length is read from the resource file into a signed 32-bit integer and compared against the destination buffer size with a signed comparison, which conditionally resizes the buffer. A negative length value skips the resize; the same value is then passed to the copy routine as an unsigned byte count, where it sign-extends to a huge value, copying file-controlled data far past the undersized heap allocation. The defect is reached when the product or an exported game loads a crafted binary resource file (.res). NOTE: the Supplier's position is that the research has identified \"no security issues\" because the required attacker access is outside of the current Godot Engine threat model."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "godotengine",
          "product": "Godot Engine",
          "defaultStatus": "unknown",
          "modules": [
            "Binary resource loader"
          ],
          "programFiles": [
            "core/io/resource_format_binary.cpp"
          ],
          "programRoutines": [
            {
              "name": "ResourceLoaderBinary::get_unicode_string"
            }
          ],
          "repo": "https://github.com/godotengine/godot",
          "versions": [
            {
              "version": "1.0.0",
              "lessThanOrEqual": "4.7.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
          "baseScore": 2.5,
          "baseSeverity": "LOW",
          "attackVector": "LOCAL",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-20T01:36:11.111269Z",
          "id": "CVE-2026-110735",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-195"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://axeghost.offprint.app/a/3mvs6zo4blo23-three-memory-safety-bugs-in-godots-untrusted-file-parsers",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/godotengine/godot/issues/123608",
      "source": "[email protected]"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/10/15/3",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}