A heap out-of-bounds read/write vulnerability exists in Godot 4.x in the binary resource loader functionality. The vulnerability occurs due to improper validation of string lengths when processing binary resources. Negative string lengths and lengths beyond the remaining file size are not properly rejected in ResourceLoaderBinary::get_unicode_string and get_ustring functions. Additionally, the bundled smaz decompressor and OptimizedTranslation message lookup lacked proper input bounds checks. The 3.x backport also addresses an out-of-bounds read on files with valid length but no null terminator by passing string length to parse_utf8.
| Vendor | Product | Versions |
|---|---|---|
| godot engine | godot | 4.x, 3.x |
Loading…
Article reveals this is also a heap out-of-bounds write (not just read) via negative string lengths in binary resource loader affecting both 3.x and 4.x; patch details confirm fix merged 2026-10-20 with backport to 3.x.
Initial creation
