Cyber ·
Godot 4.x: fix for heap overflow from negative string length in binary resources
Advisory from oss-sec on an out-of-bounds heap write in the Godot 4.x binary resource loader, caused by an invalid string length. The fix was merged upstream on 20 October 2026.
Source: advisory posted to the oss-sec feed on 23 October 2026, in automatic translation. The problem is in the Godot 4.x binary resource loader: strings with an invalid length could cause a write outside the heap bounds. The fix, referenced as PR 124699 titled Fix heap overflow with invalid string length in binary resources, was merged into the master branch on 20 October 2026 (merge commit d9f4c99f0a). According to the text, it rejects negative lengths and lengths larger than the remaining file size in get_unicode_string and get_ustring, and returns early when the length is zero in get_ustring. To consult the original, use the oss-sec advisory and the pull request listed in the official Godot repository, comparing the merge date and commit hash with the project history. Relevance: anyone distributing games or tools built on Godot 4.x should check the version in use and update when a release containing the fix is available. This is security information about third-party software; Rota Nacional does not fix or audit Godot.