CVE-2026-103414

The GUIX binary resource (theme) loader is vulnerable to an out-of-bounds write (CWE-787) due to independent cursor arithmetic used in two separate passes while traversing resource files. Because gx_page_header_data_size is not validated against actual glyph data, the loader may derive inconsiste...

CVE-2026-110735

Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader core/io/resourceformatbinary.cpp, ResourceLoaderBinary::getunicodestring. A string length is read from the resource file into a signed 32-bit integer and compared against the destination buffer size with a...

CVE-2026-110735

The Godot Engine (through version 4.7.2 ) is vulnerable to a heap out-of-bounds write in the binary resource loader, specifically within core/io/resource_format_binary.cpp at ResourceLoaderBinary::get_unicode_string. The root cause is a signed to unsigned conversion error (CWE-195) where a string...

CVE-2026-110735

Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader core/io/resourceformatbinary.cpp, ResourceLoaderBinary::getunicodestring. A string length is read from the resource file into a signed 32-bit integer and compared against the destination buffer size with a...

EUVD-2026-101305

Godot Engine through 4.7.2 has a heap out-of-bounds write exists in the binary resource loader core/io/resourceformatbinary.cpp, ResourceLoaderBinary::getunicodestring. A string length is read from the resource file into a signed 32-bit integer and compared against the destination buffer size wit...