CVE-2026-110734 godotengine CVE debrief

Who should care

Defenders responsible for Godot Engine deployments, especially those using the engine to import or process .hdr images from untrusted sources, should assess exposure and prioritize verification and remediation efforts.

Why it matters

CVE-2026-110734 is a heap out-of-bounds write vulnerability in the Godot Engine's Radiance HDR image decoder. Defenders should prioritize verifying and updating Godot Engine, reviewing .hdr image sources, and implementing input validation to prevent potential security issues.

• Verify Godot Engine version and update to a fixed version if necessary to prevent potential security issues
• Review and validate .hdr image sources to ensure they are trusted and do not pose a security risk
• Implement input validation and error handling for .hdr image processing to prevent exploitation

Technical summary

The Godot Engine's Radiance HDR (.hdr) image decoder is vulnerable to a heap out-of-bounds write. A crafted .hdr file can cause the decoder to write attacker-supplied bytes past the end of a heap allocation, potentially leading to security issues. The defect is automatically triggered when importing a crafted .hdr file or at runtime in exported projects loading untrusted .hdr images. Defenders should prioritize verifying and updating Godot Engine to a version that addresses this vulnerability, especially if they use the engine to import or process .hdr images from untrusted sources. The CVE Program record and NVD vulnerability detail provide information on the vulnerability.

Defensive priority

Defenders should prioritize verifying and updating Godot Engine to a version that addresses this vulnerability, especially if they use the engine to import or process .hdr images from untrusted sources.

Recommended defensive actions

• Verify Godot Engine version and update to a fixed version if necessary
• Review and validate .hdr image sources to ensure they are trusted
• Implement input validation and error handling for .hdr image processing
• Track exceptions and retest remediated assets
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program record and NVD vulnerability detail provide information on the vulnerability. The Godot Engine's issue tracker and a supplemental source discussing memory safety bugs in Godot's untrusted file parsers also offer context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.