CVE-2026-110734
Description
A flaw was found in Godot. The Radiance High Dynamic Range (HDR) image decoder does not validate whether compressed data instructions exceed the capacity of the allocated row buffer. An attacker can exploit this vulnerability by enticing a user to open a project containing a specially crafted HDR file or by supplying a malicious HDR image at runtime, triggering an out-of-bounds write to heap memory that may result in memory corruption or an application crash.
Statement
This vulnerability is rated as Important severity because arbitrary heap memory corruption can be triggered when processing untrusted graphical assets, which could lead to arbitrary code execution within the context of the running application. Exploitation requires user interaction to load a malicious asset or open an untrusted project, precluding remote unauthenticated exploitation without victim cooperation. Godot is not distributed as part of standard Red Hat Enterprise Linux offerings, resulting in negligible risk to default enterprise deployments.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
