A vulnerability in Godot Engine through version 4.7.2 allows for an out-of-bounds read when loading a crafted .translation resource. This can lead to a crash or disclosure of process memory. The issue is reached when the product or an exported game performs lookups in a crafted translation file. The vulnerability arises from offsets read from the hash table of a crafted .translation resource being used as [truncated]
A heap out-of-bounds write vulnerability exists in Godot Engine through version 4.7.2 when loading a crafted binary resource file (.res). The issue arises from a signed comparison that conditionally resizes a buffer, allowing for a huge value to be passed to a copy routine, resulting in data being copied far past the undersized heap allocation. This vulnerability can lead to potential data corruption or u [truncated]
A heap out-of-bounds write vulnerability exists in the Godot Engine's Radiance HDR (.hdr) image decoder. The issue occurs when the decoder processes a crafted .hdr file, allowing an attacker to write arbitrary bytes past the end of a heap allocation. This defect can be triggered automatically when importing a crafted .hdr file or at runtime in exported projects loading untrusted .hdr images.
