Godot Engine CVE-2026-110734

Exploitation requires the victim to import or load an attacker-supplied Radiance HDR (.hdr) file - for example by opening a shared Godot project that contains one, or via an exported project that loads untrusted .hdr images at runtime. The specific trigger is the HDR RLE run-length decoding path in modules/hdr/image_loader_hdr.cpp, where an instruction's repeat/copy count is not validated against remaining row-buffer capacity. Limiting factors per the CVSS vector: local vector (AV:L), high attack complexity (AC:H - depends on heap layout and a precisely crafted file), and mandatory user interaction (UI:R - the victim must choose to open/import the file). No authentication is needed (PR:N). The vendor further considers this delivery requirement outside its supported threat model, which constrains realistic risk to users handling untrusted projects or assets.

Multiple signals converge on LOW real-world priority. The NVD CVSS 3.1 base score is 2.5 (Low) with vector AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - local attack vector, high complexity, and required user interaction all sharply limit reach despite PR:N (no authentication). There is no CISA KEV listing and no EPSS score supplied, so there is no evidence of automated or in-the-wild exploitation; this aligns with 'no public exploit identified at time of analysis,' though one reference is a security-research writeup that likely contains technical reproduction detail (crafted .hdr) even if weaponized exploit code is not confirmed. A notable conflict exists: the Supplier (Godot) explicitly disputes this as a security issue, asserting the required attacker access (getting a victim to import/open an untrusted .hdr or distributing a malicious project) falls outside Godot's threat model. The CWE-787 (out-of-bounds write) with attacker-controlled overflow length and content is technically serious and could in principle exceed the modest I:L rating (potential memory corruption / code execution), but exploitation is gated behind social-engineering-style delivery and high complexity. Net: this is a genuine memory-safety defect but a low operational priority - not a drop-everything issue - barring a change in Godot's threat model or evidence of exploitation.

An attacker crafts a malicious Radiance HDR (.hdr) image whose RLE instructions specify repeat/copy counts exceeding the row buffer capacity, then distributes it inside a shared Godot project or as an asset a developer imports. When the victim opens the project or the engine loads the untrusted image, the decoder writes attacker-controlled bytes past the heap allocation, corrupting memory. A security-research reference documents the bug class, so reproduction detail is likely public, but no weaponized exploit is confirmed; the AV:L/AC:H/UI:R profile means success depends on convincing the victim to process the file and on winning heap-layout conditions.