Godot 4.x: heap out-of-bounds write in the Radiance HDR image loader (CVE-2026-110734, disputed)

The advisory was posted by Tomasz Kaye on the oss-sec list on October 15, 2026, and is an automatic translation of the original content. The flaw is in the Radiance HDR image loader of Godot 4.x and consists of an out-of-bounds write on the heap. After publication, the identifier CVE-2026-110734 was assigned. The record is marked as disputed, and its description cites the vendor's position that there are no security issues. MITRE assigned the score CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N, with a base score of 2.5. The vector indicates local access, high complexity, required user interaction, and low impact on integrity only. The author states that they filed a reconsideration request with MITRE's last-resort CVE numbering authority (CNA-LR). To verify, read the original message on the oss-sec list at the address given in the source, search for CVE-2026-110734 on the official CVE program site, and compare with the Godot release notes. Until a final decision exists, treat the status as uncertain.