{"id":39254,"date":"2026-10-16T00:35:21","date_gmt":"2026-10-15T16:35:21","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-110734"},"modified":"2026-10-16T00:35:21","modified_gmt":"2026-10-15T16:35:21","slug":"cve-2026-110734","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-110734","title":{"rendered":"CVE-2026-110734 [LOW] &#8211; Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR (.hdr) image"},"content":{"rendered":"<p>Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR (.hdr) image decoder (modules\/hdr\/image_loader_hdr.cpp). The run-length decoding loop expands RLE instructions read from the file into a buffer sized from the image dimensions, without validating that an instruction&#8217;s repeat\/copy count fits the remaining capacity of the row buffer. A crafted .hdr file therefore writes attacker-supplied bytes past the end of the heap allocation, with the overflow length and content controlled by the file. The defect is reached automatically when the product imports a crafted .hdr (e.g., when opening a project containing one), and at runtime in exported projects that load untrusted .hdr images. NOTE: the Supplier&#8217;s position is that the research has identified &#8220;no security issues&#8221; because the required attacker access is outside of the current Godot Engine threat model.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR (.hdr) image decoder (modules\/hdr\/image_loader_hdr.cpp). The run-length decoding loop expands RLE instructions read from t<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-39254","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/39254","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=39254"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=39254"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=39254"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}