A crafted Radiance HDR image triggers a heap out‑of‑bounds write in the Godot Engine image decoder. The run‑length decoding loop expands instructions read from the file into a row buffer sized by the image dimensions, but does not verify that an instruction’s repeat or copy count fits the remaining space. As a result, the decoder writes attacker‑supplied bytes beyond the heap allocation, which can corrupt engine state, cause crashes, or destabilize applications. The CVE does not indicate that it leads to code execution or privilege escalation.

Godot Engine versions 4.7.2 and earlier on all supported platforms are affected whenever a crafted .hdr file is imported, such as during project development or when an exported project loads an untrusted .hdr image at runtime.

The CVSS score of 2.5 classifies this flaw as low severity, and the EPSS score of < 1 % together with its absence from the CISA KEV catalog suggest that active exploitation is not known. Exploitation requires an attacker to supply a specially crafted .hdr file, so the attack vector is file‑based and only viable in environments where such files are processed.