Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110735

Quick assessment

Affected
godotengine Godot Engine
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Godot Engine 4.7.2 及更早版本中存在一个堆溢出写入漏洞，位于二进制资源加载器模块（core/io/resource_format_binary.cpp 中的 ResourceLoaderBinary::get_unicode_string 函数）。该漏洞的具体机制如下：从资源文件中读取的字符串长度被读入一个带符号的 32 位整数，并与目标缓冲区大小进行有符号比较，以决定是否重新调整缓冲区大小。如果长度为负值，则跳过重新调整大小的步骤；随后，该负值作为无符号字节计数传递给复制例程，在复制过程中该值会

CVSS 2.5 · Low EPSS 0.13% · P3

Affected Version Matrix 1

VendorProduct Version RangeStatus
godotengine Godot Engine 1.0.0≤ 4.7.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-110735

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/resource_format_binary.cpp, ResourceLoaderBinary::get_unicode_string). A string length is read from the resource file into a signed 32-bit integer and compared against the destination buffer size with a signed comparison, which conditionally resizes the buffer. A negative length value skips the resize; the same value is then passed to the copy routine as an unsigned byte count, where it sign-extends to a huge value, copying file-controlled data far past the undersized heap allocation. The defect is reached when the product or an exported game loads a crafted binary resource file (.res). NOTE: the Supplier's position is that the research has identified "no security issues" because the required attacker access is outside of the current Godot Engine threat model.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
有符号至无符号转换错误
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
godotengine Godot Engine 1.0.0 ~ 4.7.2 -

II. Public POCs for CVE-2026-110735

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110735

请登录查看更多情报信息。

Other References for CVE-2026-110735 (2)

Same Patch Batch · godotengine · 2026-10-14 · 3 CVEs total

CVE-2026-110736 3.6 LOW Godot 4.7.2前越界读取漏洞
CVE-2026-110734 2.5 LOW Godot Engine 4.7.2前版Hdr解码堆溢出

IV. Related Vulnerabilities

Same product: Godot Engine
Same vendor: godotengine
Same weakness: CWE-195

V. Comments for CVE-2026-110735

No comments yet

Leave a comment