CVE-2026-110734: CWE-787 Out-of-bounds Write in godotengine Godot Engine

Godot Engine through version 4.7.2 contains a heap out-of-bounds write vulnerability (CWE-787) in the Radiance HDR image decoder module. The issue arises because the run-length decoding loop expands RLE instructions from a .hdr file into a buffer sized by image dimensions without validating that the repeat/copy count fits within the remaining buffer capacity. This allows an attacker to craft a .hdr file that writes arbitrary bytes past the end of the allocated heap buffer. The vulnerability is triggered automatically when importing a crafted .hdr file or when loading untrusted .hdr images at runtime in exported projects. The vendor's position is that this does not constitute a security issue within their threat model.

The vulnerability allows an attacker with the ability to supply a crafted .hdr image file to cause a heap out-of-bounds write, potentially leading to memory corruption. However, the CVSS score is low (2.5), reflecting limited impact due to required local access and high attack complexity. There is no confidentiality or availability impact, and no known exploits in the wild. The vendor does not consider this a security issue under their threat model.

No official patch or fix is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor considers this outside the threat model, no specific mitigation actions are mandated. Users should avoid importing untrusted .hdr files or loading untrusted .hdr images in exported projects to reduce risk.