CVE-2026-1107342.5LowCWE-787

CVE-2026-110734: godotengine Godot Engine vulnerability

godotengine · Godot Engine

Affected: godotengine Godot Engine · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.2%probability of exploitation in the next 30 days

4th percentile

050100

Higher than 4% of scored CVEs

2.5LowCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR (.hdr) image decoder (modules/hdr/image_loader_hdr.cpp). The run-length decoding loop expands RLE instructions read from the file into a buffer sized from the image dimensions, without validating that an instruction's repeat/copy count fits the remaining capacity of the row buffer. A crafted .hdr file therefore writes attacker-supplied bytes past the end of the heap allocation, with the overflow length and content controlled by the file. The defect is reached automatically when the product imports a crafted .hdr (e.g., when opening a project containing one), and at runtime in exported projects that load untrusted .hdr images. NOTE: the Supplier's position is that the research has identified "no security issues" because the required attacker access is outside of the current Godot Engine threat model.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

godotengine · Godot Enginefrom 3.0.0 up to and including 4.7.2

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Out-of-bounds Write · Memory Corruption
Vendor: godotengine
Published: October 2026
Band: Unlikely (under 1%), October 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-110734 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.