Debian/godot: low 2.5
Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/resource_format_binary.cpp, ResourceLoaderBinary::get_unicode_string). A string length is read from the
Action: Upgrade godot to 4.6.3+ds-3 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.6.3+ds-3 | - |
Fixed versions
| 4.6.3+ds-3 |
Sources
- osv: DEBIAN-CVE-2026-110735#Debian:14/godot
- https://security-tracker.debian.org/tracker/CVE-2026-110735
published · modified · JSON