Description
Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/resource_format_binary.cpp, ResourceLoaderBinary::get_unicode_string). A string length is read from the resource file into a signed 32-bit integer and compared against the destination buffer size with a signed comparison, which conditionally resizes the buffer. A negative length value skips the resize; the same value is then passed to the copy routine as an unsigned byte count, where it sign-extends to a huge value, copying file-controlled data far past the undersized heap allocation. The defect is reached when the product or an exported game loads a crafted binary resource file (.res). NOTE: the Supplier's position is that the research has identified "no security issues" because the required attacker access is outside of the current Godot Engine threat model.
Published: 2026-10-14
Score: 2.5 Low
EPSS: < 1% Very Low
KEV: No
Impact: Heap out‑of‑bounds write causing memory corruption
Action: Assess Impact
AI Analysis

Impact

A signed 32‑bit length value read from a binary resource file is compared against a buffer size with a signed comparison. If the value is negative, the buffer is not resized, yet the same negative number is later interpreted as an unsigned byte count. The sign‑extension turns the negative length into a very large positive value, causing the copy routine to write far beyond the allocated space. The overflow can corrupt adjacent heap objects, potentially leading to crash or, if an attacker can control the data, arbitrary code execution. The flaw is rated CVSS 2.5, indicating low overall severity.

Affected Systems

The defect affects Godot Engine versions up to and including 4.7.2. Any application built with the engine that loads a binary resource file (.res) is susceptible, whether this is the engine itself or an exported game. The vulnerability resides in the binary resource loader component.

Risk and Exploitability

The CVSS score of 2.5 points to limited impact. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a low probability of widespread exploitation. An attacker must supply a crafted .res file that the engine processes, so the threat is confined to scenarios where untrusted content can be loaded. The vendor’s assessment of “no security issues” reflects that the typical threat model does not assume an attacker can supply such files.

Generated by OpenCVE AI on October 15, 2026 at 18:14 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any official patch or update released by Godot Engine that addresses the buffer overrun in the binary resource loader.
  • If a patch is not yet available, restrict the engine or game from loading binary resource files (.res) from untrusted directories or disable binary resource loading in project settings.
  • When running in a sandboxed environment, monitor for abnormal memory usage or crashes that could signal exploitation, and consider adding bounds checks to the resource loading routine.

Generated by OpenCVE AI on October 15, 2026 at 18:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Title Heap Out-of-Bounds Write in Binary Resource Loader

Thu, 15 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
References

Thu, 15 Oct 2026 01:45:00 +0000

Type Values Removed Values Added
Title Heap Out-of-Bounds Write in Binary Resource Loader

Thu, 15 Oct 2026 01:00:00 +0000

Type Values Removed Values Added
Description Godot Engine through 4.7.2 has a heap out-of-bounds write exists in the binary resource loader (core/io/resource_format_binary.cpp, ResourceLoaderBinary::get_unicode_string). A string length is read from the resource file into a signed 32-bit integer and compared against the destination buffer size with a signed comparison, which conditionally resizes the buffer. A negative length value skips the resize; the same value is then passed to the copy routine as an unsigned byte count, where it sign-extends to a huge value, copying file-controlled data far past the undersized heap allocation. The defect is reached when the product or an exported game loads a crafted binary resource file (.res). NOTE: the Supplier's position is that the research has identified "no security issues" because the required attacker access is outside of the current Godot Engine threat model. Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/resource_format_binary.cpp, ResourceLoaderBinary::get_unicode_string). A string length is read from the resource file into a signed 32-bit integer and compared against the destination buffer size with a signed comparison, which conditionally resizes the buffer. A negative length value skips the resize; the same value is then passed to the copy routine as an unsigned byte count, where it sign-extends to a huge value, copying file-controlled data far past the undersized heap allocation. The defect is reached when the product or an exported game loads a crafted binary resource file (.res). NOTE: the Supplier's position is that the research has identified "no security issues" because the required attacker access is outside of the current Godot Engine threat model.

Wed, 14 Oct 2026 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Godotengine
Godotengine godot Engine
CPEs cpe:2.3:a:godotengine:godot_engine:*:*:*:*:*:*:*:*
Vendors & Products Godotengine
Godotengine godot Engine

Wed, 14 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description Godot Engine through 4.7.2 has a heap out-of-bounds write exists in the binary resource loader (core/io/resource_format_binary.cpp, ResourceLoaderBinary::get_unicode_string). A string length is read from the resource file into a signed 32-bit integer and compared against the destination buffer size with a signed comparison, which conditionally resizes the buffer. A negative length value skips the resize; the same value is then passed to the copy routine as an unsigned byte count, where it sign-extends to a huge value, copying file-controlled data far past the undersized heap allocation. The defect is reached when the product or an exported game loads a crafted binary resource file (.res). NOTE: the Supplier's position is that the research has identified "no security issues" because the required attacker access is outside of the current Godot Engine threat model.
Weaknesses CWE-195
References
Metrics cvssV3_1

{'score': 2.5, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N'}

Subscriptions

Godotengine Godot Engine
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-10-20T01:36:20.303Z

Reserved: 2026-10-14T15:41:49.785Z

Link: CVE-2026-110735

cve-icon Vulnrichment

Updated: 2026-10-15T16:08:06.535Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-14T16:17:44.467

Modified: 2026-10-20T02:17:10.757

Link: CVE-2026-110735

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T12:15:07Z

Weaknesses
  • CWE-195

    Signed to Unsigned Conversion Error