Follow-up: a CVE identifier has been assigned for this issue.

CVE-2026-110735 — record: https://www.cve.org/CVERecord?id=CVE-2026-110735

The record is tagged "disputed"; the description quotes the supplier position ("no security issues"). MITRE scored it CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N (2.5). I have filed a reconsideration request with MITRE's CVE Numbering Authority of Last Resort (CNA-LR), asking for CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8). NVD analysis is pending.

Still unpatched upstream as of 2026-10-15.

Tomasz Kaye

Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader (core/string/optimizedtranslation.cpp, OptimizedTranslation::getmessage). Offsets read from the hash table of a crafted .translation resource are used as indices into the bucket table without bounds validation; only a single sentinel value is rejected. A crafted file can point an index far past the allocated buffer. Depending on the values, the result is a crash, or a string lookup (tr()) returns raw bytes from elsewhere in the process heap as the translated string, disclosing process memory. The defect is reached when the product or an exported game loads and performs lookups in a crafted translation file. NOTE: the Supplier's position is that the research has identified "no security issues" because the required attacker access is outside of the current Godot Engine threat model.

Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/resourceformatbinary.cpp, ResourceLoaderBinary::getunicodestring). A string length is read from the resource file into a signed 32-bit integer and compared against the destination buffer size with a signed comparison, which conditionally resizes the buffer. A negative length value skips the resize; the same value is then passed to the copy routine as an unsigned byte count, where it sign-extends to a huge value, copying file-controlled data far past the undersized heap allocation. The defect is reached when the product or an exported game loads a crafted binary resource file (.res). NOTE: the Supplier's position is that the research has identified "no security issues" because the required attacker access is outside of the current Godot Engine threat model.

Three memory-safety bugs in Godot 4's untrusted-file parsers were publicly disclosed on 2026-09-21 [1]. This thread covers the HDR loader bug.

Affected versions: Godot 4.7-stable, official release build (commit 5b4e0cb0f), verified. Earlier 4.x presumed affected. The loader was added in May 2017 (commit bb20f230ad). Unpatched as of 2026-10-13 (checked on master, 4.7.2, 4.7.1, 4.7).

Description: ImageLoaderHDR::loadimage (modules/hdr/imageloaderhdr.cpp, lines 104-118) decodes Radiance HDR run-length data. Run and dump counts read from the file are trusted without checking them against the reserved image buffer. A crafted .hdr file directs the decoder to write attacker-controlled data past the end of the heap buffer.

Impact: Attacker-controlled heap out-of-bounds write, confirmed by heap-corruption crash on the official 4.7 release build (STATUSHEAPCORRUPTION, 0xC0000374). Reachable when Godot imports a malicious .hdr file. The HDR loader ships in export templates; an exported game that loads player- or community-supplied .hdr files (mods, downloads, uploads) runs this code on untrusted input.

Reproduction: Archive (evil4ch.hdr, ok.hdr, repro.gd, verify.ps1, project.godot), with extracted contents and per-bug README: https://github.com/bitbutter/godot-security-pocs/tree/main/2026-09-untrusted-file-parsers/hdr SHA-256 of the original archive (godot47hdroobrepro.zip): 604982a1d0f8b0b7f19ec9a75d565f51a7879f2cdddf898c58234bef6e54f380 verify.ps1 runs both files through an official 4.7 build; the crafted file exits with STATUSHEAPCORRUPTION (0xC0000374), the valid baseline exits 0. The same archive was distributed with the original report and is linked from the correspondence section of the disclosure post [1].

Fix status: Unpatched as of 2026-10-13 (master, 4.7.2, 4.7.1, 4.7).

CVE status: Requested from MITRE's CVE Numbering Authority of Last Resort (CNA-LR) on 2026-09-20, prior to publication. No IDs assigned as of 2026-10-14; this thread will be self-replied when IDs arrive.

Timeline (dates and links only): 2026-06-22 — reported privately to security () godotengine org with reproduction and suggested patch. 2026-09-18 — public notice: https://github.com/godotengine/godot/issues/123608 2026-09-19 — vendor response classifying the issues as not security issues: https://github.com/godotengine/godot/issues/123608

Credit: Found during an automated audit directed by the reporter (LLM-driven source analysis; Claude Code — discovery by Opus 4.8, report and reproduction by Sonnet 4.6). Reproductions verified against official release binaries. Reported and disclosed by Tomasz Kaye.

[1] https://axeghost.offprint.app/a/3mvs6zo4blo23-three-memory-safety-bugs-in-godots-untrusted-file-parsers

Three memory-safety bugs in Godot 4's untrusted-file parsers were publicly disclosed on 2026-09-21 [1]. This thread covers the binary resource loader bug.

Affected versions: Godot 4.7-stable, official release build, verified. Earlier versions presumed affected. The parser has been in the engine since the day it was open-sourced in 2014 (commit 0b806ee0fc). Unpatched as of 2026-10-13 (master, 4.7.2, 4.7.1, 4.7).

Description: ResourceLoaderBinary::getunicodestring (core/io/resourceformatbinary.cpp:864) reads a 32-bit string length from the file. A length with the high bit set is negative; the size guard does not catch the negative value, and the subsequent copy uses the value as a huge unsigned size, writing past the end of the undersized heap buffer. AddressSanitizer reports heap-buffer-overflow WRITE at resourceformatbinary.cpp:872.

Impact: Attacker-controlled heap out-of-bounds write on load. The binary resource loader ships in export templates; an exported game that loads player- or community-supplied .res files runs this code on untrusted input.

Reproduction: Archive godot47binresoobrepro.zip (README, buganalysis.md, makerepro.py regenerates the crafted resource), with extracted contents and per-bug README: https://github.com/bitbutter/godot-security-pocs/tree/main/2026-09-untrusted-file-parsers/binres SHA-256: 920daf712f53fd8e0085bfc148c5ea5c6839d4136bf6e0d13a14a3e4385a4620 Trigger paths (Windows): placing the crafted .res in a project folder crashes the editor on startup (resource-dependency scan, no user action); a headless script load exits with STATUSHEAPCORRUPTION (0xC0000374). Under AddressSanitizer or PageHeap, a 4 KiB payload yields an immediate heap-buffer-overflow WRITE at resourceformatbinary.cpp:872. The same archive was distributed with the original report and is linked from the correspondence section of the disclosure post [1].

Fix status: Unpatched as of 2026-10-13 (master, 4.7.2, 4.7.1, 4.7).

CVE status: Requested from MITRE's CVE Numbering Authority of Last Resort (CNA-LR) on 2026-09-20, prior to publication. No IDs assigned as of 2026-10-14; this thread will be self-replied when IDs arrive.

Timeline (dates and links only): 2026-06-23 — reported privately to security () godotengine org with reproduction and suggested patch. 2026-09-18 — public notice: https://github.com/godotengine/godot/issues/123608 2026-09-19 — vendor response classifying the issues as not security issues: https://github.com/godotengine/godot/issues/123608

Credit: Found during an automated audit directed by the reporter (LLM-driven source analysis; Claude Code — discovery by Opus 4.8, report and reproduction by Sonnet 4.6). Reproductions verified against official release binaries. Reported and disclosed by Tomasz Kaye.

[1] https://axeghost.offprint.app/a/3mvs6zo4blo23-three-memory-safety-bugs-in-godots-untrusted-file-parsers

Three memory-safety bugs in Godot 4's untrusted-file parsers were publicly disclosed on 2026-09-21 [1]. This thread covers the OptimizedTranslation bug.

Affected versions: Godot 4.7-stable, official release build, verified. Earlier versions presumed affected. The loader has been in the engine since 2014 (commit 0b806ee0fc). Unpatched as of 2026-10-13 (master, 4.7.2, 4.7.1, 4.7).

Description: OptimizedTranslation::getmessage (core/string/optimizedtranslation.cpp) looks up strings through a hash table read verbatim from the compiled translation resource. A crafted .translation or .tres resource of this type is a full control surface: the uint32t table entry is used as an index into the bucket table with no bounds check — only the sentinel 0xFFFFFFFF is rejected — and the bucket's string offset is used against the strings array without a bounds check. As of 4.7-stable the unchecked bucket load is at line 259 and the unchecked string read at line 277; the identical pattern is present in gettranslatedmessagelist() (line 299).

Impact: Crash: the first tr() call through a far out-of-range entry faults, deterministically on stock 64-bit binaries, editor and export templates. Information disclosure: tr() returns bytes read from an attacker-chosen offset past the end of the strings buffer reaching GDScript callers, game UI, logs, or network output. The translation loader ships in export templates; an exported game that loads player- or community-supplied translation resources runs this code on untrusted input.

Reproduction: Archive godot47optimizedtranslationoobrepro.zip (README, buganalysis.md, makerepro.py; crash and info-leak variants of the crafted resource), with extracted contents and per-bug README: https://github.com/bitbutter/godot-security-pocs/tree/main/2026-09-untrusted-file-parsers/optimized-translation SHA-256: 19cc54698b40c15e214ce310307fc854b58e631e577c61647aca12ab442d0a70 Crash variant: the first tr() call faults on a stock 64-bit binary. Leak variant: tr() returns heap bytes as the translated string; confirmed during the audit on an official 4.7 build without instrumentation. Under AddressSanitizer the leak variant reports heap-buffer-overflow READ at optimizedtranslation.cpp:277. The same archive was distributed with the original report and is linked from the correspondence section of the disclosure post [1].

Fix status: Unpatched as of 2026-10-13 (master, 4.7.2, 4.7.1, 4.7).

CVE status: Requested from MITRE's CVE Numbering Authority of Last Resort (CNA-LR) on 2026-09-20, prior to publication. No IDs assigned as of 2026-10-14; this thread will be self-replied when IDs arrive.

Timeline 2026-06-23 — reported privately to security () godotengine org with reproduction and suggested patch. 2026-09-18 — public notice: https://github.com/godotengine/godot/issues/123608 2026-09-19 — vendor response classifying the issues as not security issues: https://github.com/godotengine/godot/issues/123608

Credit: Found during an automated audit directed by the reporter (LLM-driven source analysis; Claude Code — discovery by Opus 4.8, report and reproduction by Sonnet 4.6). Reproductions verified against official release binaries. Reported and disclosed by Tomasz Kaye.

[1] https://axeghost.offprint.app/a/3mvs6zo4blo23-three-memory-safety-bugs-in-godots-untrusted-file-parsers