Public update on an out-of-bounds heap write caused by a negative string length in the binary resource loader of Godot 4.x. Identifier CVE-2026-110735 was assigned, but the record is marked as disputed.
According to the update posted to the oss-sec list on October 15, 2026, a flaw in Godot 4.x allows an out-of-bounds heap write when the binary resource loader receives a negative string length. The identifier CVE-2026-110735 was assigned. MITRE scored it CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N, equivalent to 2.5.
The CVE record is marked as disputed, and its description cites the vendor position that there are no security issues. The author states that a reconsideration request was submitted to the MITRE CNA Last Resort (CNA-LR). The outcome of that request is not part of the text.
To consult and verify, read the original message in the 2026 oss-sec archive and the CVE record in the public CVE catalog, without relying on this summary. The text does not state affected versions or a fix; confirm those details directly with the Godot project.