Re: Godot 4.x: heap out-of-bounds write in Radiance HDR image loader

Posted by Tomasz Kaye on Oct 23 Follow-up: the fix for this issue has been merged upstream. PR #124697, "Fix out-of-bounds write when loading corrupt HDR images", merged to master on 20-Oct-2026 (merge commit aef8e1f55a): https://github.com/godotengine/godot/pull/124697 The patch rejects non-positive and oversized image dimensions and bounds each RLE run and dump against the remaining scanline width. The PR body cites CVE-2026-110734 and states the vendor's...

Published 24-Oct-2026 01:45 UTC · First seen 24-Oct-2026 01:40 UTC

Sources

• Open Source Security · 23-Oct-2026