CVE-2026-110734

The Godot Engine through version 4.7.2 is vulnerable to a heap out-of-bounds write within the Radiance HDR (.hdr) image decoder (specifically in modules/hdr/image_loader_hdr.cpp). The root cause is a lack of validation in the run-length decoding loop, where RLE instructions are expanded into a bu...