https://seclists.org/oss-sec/2026/q4/166: Godot 4.x: heap out-of-bounds write via negative string length in binary source loader
Published Oct 15, 2026
·Updated
Affected Software
1 affected component
Godot Godot Engine=4.x
MITRE's current CVSS vector rates the issue as local attack vector, no privileges required, and user interaction required. The current MITRE rating also marks attack complexity as high.
The issue was reported as still unpatched upstream as of 2026-10-15. No temporary mitigation or workaround is provided in the available information.
The CVE record is tagged disputed and quotes the supplier position that there are no security issues. MITRE assigned a 2.5 CVSS 3.1 score, while the reporter requested reconsideration with a proposed 7.8 score; NVD analysis was pending.