https://seclists.org/oss-sec/2026/q4/159: Godot 4.x: heap out-of-bounds write via negative string length in binary source loader
Published Oct 14, 2026
·Updated
Affected Software
1 affected component
Godot Godot=4.7, =4.7.1, =4.7.2
Godot 4.7-stable official release builds are verified affected, and earlier versions are presumed affected. The binary resource loader is included in export templates, so exported games are exposed when they load player- or community-supplied .res files.
An attacker needs to cause the target to load a crafted binary .res resource file. The malicious file supplies a 32-bit string length with its high bit set, which is interpreted as negative by the parser and later used as a huge unsigned copy size.
The vulnerable binary resource loader ships in export templates, but exploitation depends on the game loading untrusted .res files. The provided information does not establish exposure for games that never load player- or community-supplied resources.
No. The issue was reported as unpatched as of 2026-10-13 in master, 4.7.2, 4.7.1, and 4.7.