https://seclists.org/oss-sec/2026/q4/160: Godot 4.x: heap out-of-bounds write in Radiance HDR image loader
Published Oct 14, 2026
·Updated
Affected Software
1 affected component
Godot Godot=4.7-stable, =4.7.1, =4.7.2
Godot is exposed when it imports a malicious .hdr file. Exported games also include the HDR loader, but are only exposed if they load .hdr files supplied by players or communities, such as through mods, downloads, or uploads.
An attacker needs to provide a crafted Radiance HDR (.hdr) file that is processed by Godot's HDR image loader. The malformed run-length data causes attacker-controlled data to be written past the reserved heap buffer.
The official Godot 4.7-stable release build at commit 5b4e0cb0f was verified affected. Earlier 4.x versions are presumed affected because the loader was added in May 2017, and master, 4.7.2, 4.7.1, and 4.7 were reported unpatched as of 2026-10-13.