Godot 4.x Radiance HDR loader heap out-of-bounds write disputed

A heap out-of-bounds write vulnerability has been identified in the Radiance HDR image loader component of Godot 4.x. This issue affects environments using the open-source game engine. The matter was highlighted by Tomasz Kaye on 15 October in a follow-up post on the oss-security mailing list. The vulnerability is associated with the processing of Radiance HDR image files within the engine. The CVE record notes the vendor’s position that there are no security issues.

Root cause

The vulnerability is classified as a heap out-of-bounds write within the Radiance HDR image loader. The source material does not detail the specific code logic or bounds checking failures that lead to this condition. It simply identifies the bug class and the affected component. The issue arises during the handling of Radiance HDR images by the Godot 4.x engine. No further technical explanation of the root cause is provided in the advisory.

Attack path

The CVE record includes a CVSS vector string indicating local access, high complexity, no privileges required, and user interaction. The attack path involves the processing of a file by the vulnerable image loader. The user interaction requirement suggests a victim must actively engage with the malicious input. The high complexity rating implies that exploitation may require specific conditions or precise input crafting. The impact is limited to integrity, with no confidentiality or availability impact noted.

Affected versions

• Godot 4.x versions containing the vulnerable Radiance HDR image loader.
• Specific minor or patch versions are not listed in the source material.
• The vulnerability is tied to the image loading functionality in the engine.

Mitigation

• Avoid processing untrusted Radiance HDR image files in Godot 4.x.
• Monitor vendor communications for any future updates or clarifications.
• Implement strict input validation for image files processed by the engine.
• Keep systems updated once the vendor provides an official update addressing the concern.

Signals worth monitoring

Security teams should monitor application crash logs and memory access violations within game engine processes. Look for unexpected terminations when handling image imports or asset loading tasks. Check for anomalous heap allocation patterns or access faults in debug outputs. Investigate any instances where the engine behaves erratically after processing user-provided media files. Review audit trails for unusual file access patterns involving image assets. Ensure logging is enabled for application-level errors to capture early signs of memory corruption.

What to do and how to stay safe: Godot

• Restrict the types of image files users can upload or process in production environments.
• Validate all incoming media files against strict schema definitions before processing.
• Monitor application stability metrics for sudden spikes in crashes or memory errors.
• Review access controls to limit who can trigger image loading operations in the engine.

Step-by-step guide: Out-of-band patches: what small businesses need to know

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-110734?

MITRE scored the vulnerability at 2.5 on the CVSS 3.1 scale, indicating low severity.

Does the Godot vendor consider this a security issue?

No, the vendor’s position quoted in the CVE record states there are no security issues.

Is the CVE record considered final?

The record is tagged as disputed, and a reconsideration request has been filed with MITRE.