debian/godot vulnerabilities

Latest debian/godot CVEs

Newest publication first

1. CVE-2021-26825 An integer overflow issue exists in Godot Engine up to v3.2 that can be triggered when loading specially crafted.TGA image files. The vulnerability exists in ImageLoaderTGA::load_image() function at l...

   Published 2021-02-08

   High·CVSS 7.8 EPSS 1.6%

   An integer overflow issue exists in Godot Engine up to v3.2 that can be triggered when loading specially crafted.TGA image files. The vulnerability exists in ImageLoaderTGA::load_image() function at line: const size_t buffer_size = (tga_header.image_width * tga_header.image_heigh...

2. CVE-2021-26826 A stack overflow issue exists in Godot Engine up to v3.2 and is caused by improper boundary checks when loading .TGA image files. Depending on the context of the application, attack vector can be loca...

   Published 2021-02-08

   High·CVSS 7.8 EPSS 1.6%

   A stack overflow issue exists in Godot Engine up to v3.2 and is caused by improper boundary checks when loading .TGA image files. Depending on the context of the application, attack vector can be local or remote, and can lead to code execution and/or system crash.

3. CVE-2019-10069 In Godot through 3.1, remote code execution is possible due to the deserialization policy not being applied correctly.

   Published 2019-05-31

   Critical·CVSS 9.8 EPSS 3.4%

   In Godot through 3.1, remote code execution is possible due to the deserialization policy not being applied correctly.

4. CVE-2018-1000224 Godot Engine version All versions prior to 2.1.5, all 3.0 versions prior to 3.0.6. contains a Signed/unsigned comparison, wrong buffer size chackes, integer overflow, missing padding initialization vu...

   Published 2018-08-20

   High·CVSS 7.5 EPSS 3.8%

   Godot Engine version All versions prior to 2.1.5, all 3.0 versions prior to 3.0.6. contains a Signed/unsigned comparison, wrong buffer size chackes, integer overflow, missing padding initialization vulnerability in (De)Serialization functions (core/io/marshalls.cpp) that can resu...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.