CVE-2026-110735 godotengine CVE debrief

Who should care

Defenders responsible for systems using Godot Engine, especially those in environments where untrusted files may be loaded, should assess exposure and verify the integrity of loaded binary resource files.

Why it matters

CVE-2026-110735 is a heap out-of-bounds write vulnerability in Godot Engine through version 4.7.2. Defenders should care because it allows for potential data corruption or unexpected behavior when loading crafted binary resource files. The vulnerability requires verification of loaded file integrity and possibly upgrading to a fixed version of Godot Engine.

• Potential for data corruption or unexpected behavior when loading crafted binary resource files
• Need for verification of loaded file integrity to prevent exploitation
• Possible impact on system stability or security in environments where untrusted files are loaded
• Requirement for upgrading to a fixed version of Godot Engine to address the vulnerability

Technical summary

The vulnerability exists in the binary resource loader of Godot Engine (core/io/resource_format_binary.cpp, ResourceLoaderBinary::get_unicode_string). A string length read from a resource file into a signed 32-bit integer is compared against the destination buffer size with a signed comparison. If the length value is negative, it skips resizing the buffer; this same value is then passed as an unsigned byte count to a copy routine, where it sign-extends to a huge value. This results in copying file-controlled data far past the undersized heap allocation when loading a crafted binary resource file (.res).

Defensive priority

Defenders should prioritize verifying the integrity of loaded binary resource files and assess exposure in systems using Godot Engine, especially in environments where untrusted files may be loaded.

Recommended defensive actions

• Verify the integrity of loaded binary resource files
• Assess exposure in systems using Godot Engine, especially in environments where untrusted files may be loaded
• Consider upgrading to a version of Godot Engine that addresses this vulnerability
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence in Godot Engine through version 4.7.2 and the conditions under which the heap out-of-bounds write occurs. However, the impact and remediation details are limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.