Cyber ·
Godot 4.x fixes out-of-bounds write in the Radiance HDR image loader
oss-sec advisory on the fix, already merged upstream into Godot's master branch, for an out-of-bounds heap write when loading corrupted Radiance HDR images, referencing CVE-2026-110734.
The advisory was posted to the oss-sec feed by Tomasz Kaye on 23 October 2026 and reports that the fix for an out-of-bounds write when loading corrupted HDR images has been merged upstream into Godot 4.x. According to the text, PR #124697, titled "Corrige gravação fora dos limites ao carregar imagens HDR corrompidas", was merged into the master branch on 20 October 2026, with merge commit aef8e1f55a.
According to the description of the fix, the code now rejects image dimensions that are not positive or are too large. It also limits each RLE run and each data block to the remaining width of the scanline. The PR text cites the identifier CVE-2026-110734 and states the vendor's assessment, but the excerpt available in this curation is truncated and does not detail that assessment.
The relevance for people following software security is the failure pattern: insufficient validation of dimensions and block sizes in binary formats. To verify the details, consult the original oss-sec advisory and the PR it cites in Godot's official repository, which define the scope, severity and affected versions.