{"schema_version":"1","data":[{"id":19311,"advisory_id":"225bfa82-0dae-489e-a890-952f5633acdb","revision":1,"source_id":"oss-security","source_url":"https://seclists.org/oss-sec/2026/q4/364","source_published_at":"2026-10-23T22:18:16+00:00","published_at":"2026-10-25T02:22:21.622457+00:00","extraction_method":"llm","technologies":["godot","oss-security"],"cve_ids":["CVE-2026-110734"],"event_types":["patch"],"payload":{"kind":"patch","title":"Godot 4.x: heap out-of-bounds write in Radiance HDR image loader","summary":"A fix for an out-of-bounds write when loading corrupt HDR images was merged upstream. The patch validates image dimensions and bounds RLE runs and dumps against the remaining scanline width.","evidence":"the fix for this issue has been merged upstream. PR #124697, \"Fix out-of-bounds write when loading corrupt HDR images\", merged to master on 2026-10-20","products":[{"name":{"value":"Godot","evidence":"Godot 4.x: heap out-of-bounds write in Radiance HDR image loader"},"prerequisites":[],"fixed_versions":[{"value":"master","evidence":"merged to master on 2026-10-20"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-110734","evidence":"The PR body cites CVE-2026-110734"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false}],"next_after":19311,"next_before":19311}