Source: godot Version: 4.6.3+ds-2 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerabilities were published for godot. CVE-2026-110734[0]: | Godot Engine through 4.7.2 has a heap out-of-bounds write in the | Radiance HDR (.hdr) image decoder | (modules/hdr/image_loader_hdr.cpp). The run-length decoding loop | expands RLE instructions read from the file into a buffer sized from | the image dimensions, without validating that an instruction's | repeat/copy count fits the remaining capacity of the row buffer. A | crafted .hdr file therefore writes attacker-supplied bytes past the | end of the heap allocation, with the overflow length and content | controlled by the file. The defect is reached automatically when the | product imports a crafted .hdr (e.g., when opening a project | containing one), and at runtime in exported projects that load | untrusted .hdr images. NOTE: the Supplier's position is that the | research has identified "no security issues" because the required | attacker access is outside of the current Godot Engine threat model. CVE-2026-110735[1]: | Godot Engine through 4.7.2 has a heap out-of-bounds write in the | binary resource loader (core/io/resource_format_binary.cpp, | ResourceLoaderBinary::get_unicode_string). A string length is read | from the resource file into a signed 32-bit integer and compared | against the destination buffer size with a signed comparison, which | conditionally resizes the buffer. A negative length value skips the | resize; the same value is then passed to the copy routine as an | unsigned byte count, where it sign-extends to a huge value, copying | file-controlled data far past the undersized heap allocation. The | defect is reached when the product or an exported game loads a | crafted binary resource file (.res). NOTE: the Supplier's position | is that the research has identified "no security issues" because the | required attacker access is outside of the current Godot Engine | threat model. CVE-2026-110736[2]: | Godot Engine through 4.7.2 has an out-of-bounds read in the | optimized translation loader (core/string/optimized_translation.cpp, | OptimizedTranslation::get_message). Offsets read from the hash table | of a crafted .translation resource are used as indices into the | bucket table without bounds validation; only a single sentinel value | is rejected. A crafted file can point an index far past the | allocated buffer. Depending on the values, the result is a crash, or | a string lookup (tr()) returns raw bytes from elsewhere in the | process heap as the translated string, disclosing process memory. | The defect is reached when the product or an exported game loads and | performs lookups in a crafted translation file. NOTE: the Supplier's | position is that the research has identified "no security issues" | because the required attacker access is outside of the current Godot | Engine threat model. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-110734 https://www.cve.org/CVERecord?id=CVE-2026-110734 https://github.com/godotengine/godot/pull/124697 [1] https://security-tracker.debian.org/tracker/CVE-2026-110735 https://www.cve.org/CVERecord?id=CVE-2026-110735 https://github.com/godotengine/godot/pull/124699 [2] https://security-tracker.debian.org/tracker/CVE-2026-110736 https://www.cve.org/CVERecord?id=CVE-2026-110736 https://github.com/godotengine/godot/pull/124701 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
