Godot 4.x heap out-of-bounds bugs remain unpatched despite CVE assignment

Three memory-safety bugs in Godot 4's untrusted-file parsers were publicly disclosed on 2026-09-21. These flaws affect the official release build of Godot 4.7-stable and are presumed to exist in earlier versions.

What happened

Security researcher Tomasz Kaye posted advisories on the oss-security mailing list on Oct 14 and Oct 15 regarding these issues. The disclosures cover a heap out-of-bounds read in the OptimizedTranslation message lookup and a heap out-of-bounds write in the Radiance HDR image loader. The OptimizedTranslation loader has been part of the engine since 2014, while the HDR loader was added in May 2017.

Kaye verified the bugs in Godot 4.7-stable official release builds. He checked master branches and versions 4.7.2, 4.7.1, and 4.7 on 2026-10-13 and found them unpatched. The loader code responsible for these issues was identified by specific commit hashes in the source material.

A CVE identifier, CVE-2026-110736, was assigned for the OptimizedTranslation bug. The record is tagged as disputed because the supplier stated there are no security issues. Kaye filed a reconsideration request with MITRE's CVE Numbering Authority of Last Resort.

Why it matters

MITRE scored CVE-2026-110736 with a CVSS 3.1 score of 3.6, which falls in the low severity range. The vector string indicates local access with high complexity and required user interaction. Despite the low score, the supplier's position is disputed, and the vendor has not released a fix.

The unpatched status of these memory-safety bugs leaves systems exposed to potential exploitation. The presence of heap out-of-bounds writes in the HDR loader could allow for more severe consequences than simple data reads. Teams must assess their exposure to untrusted file inputs.

What to watch

• Monitor oss-security for updates on the CVE reconsideration request.
• Check for new commits in Godot master or 4.x branches that address these loaders.
• Review logs for anomalous behavior when processing OptimizedTranslation or HDR files.
• Watch for vendor statements confirming a patch release schedule.

Who needs to act first

Teams should prioritize updating systems that process untrusted files from external users or networks. Identify assets running Godot 4.x in public-facing environments or content pipelines. If no fix is available, restrict file upload capabilities to trusted sources only. Verify that input validation is enforced at the application layer before files reach the engine. Isolate vulnerable instances from critical infrastructure to limit potential impact.

What to do and how to stay safe: Godot

• Audit all systems running Godot 4.7-stable or earlier 4.x versions for exposure to untrusted files.
• Implement strict input validation for OptimizedTranslation and Radiance HDR files before they are processed.
• Restrict access to file processing services to trusted internal networks or authenticated users only.
• Monitor for vendor advisories or community patches that address these specific memory-safety bugs.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Godot versions are affected by these vulnerabilities?

Godot 4.7-stable is verified affected, and earlier 4.x versions are presumed affected.

Is there a fix available for these bugs?

No fix has been confirmed yet for any version as of October 13, 2026.

What is the severity of the assigned CVE?

MITRE scored CVE-2026-110736 as low severity with a CVSS 3.1 score of 3.6.