Posted by Tomasz Kaye on Oct 23 Follow-up: the fix for this issue has been merged upstream. PR #124699, "Fix heap overflow with invalid string length in binary resources", merged to master on 2026-10-20 (merge commit d9f4c99f0a): https://github.com/godotengine/godot/pull/124699 The patch rejects negative lengths, and lengths beyond the remaining file size, in ResourceLoaderBinary::get_unicode_string and get_ustring, and returns early on a zero length in get_ustring
Re: Godot 4.x: heap out-of-bounds write via negative string length in binary resource loader
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/365
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
PIMROP: A Feasibility Study of Return-Oriented Programming on Commercial Processing-in-Memory Architectures
arXiv:2611.06036v1 Announce Type: new Abstract: Processing-in-Memory places small programmable cores on the memory device, where they execute beside the DRAM banks and…
Multiple vulnerabilities in C-Kermit
Posted by John Goerzen on Nov 01 A recent code quality sweep and audit uncovered multiple vulnerabilities in C-Kermit, some of which can lead to an RCE when working with…
DefenderKiller: How Vulnerable Drivers Are Being Abused to Disable Endpoint Security
Table Of ContentsTable of ContentsDefenderKiller Exploits a Legacy Microsoft DriverImplications for Endpoint SecurityIndicators of Compromise and Technical ArtifactsStay…
CVE-2026-97631: Pre-boot RCE in EDK II PXE driver
Posted by Valtteri Vuorikoski on Oct 28 Ars Technica reported on this yesterday so let's have it here too. Copied from the advisory on the edk2 repo: Summary While a…
Before you file that AI bug report, OpenAI has some advice
Even OpenAI is admitting there is a lot of AI slop in the security space. An executive for the frontier AI company said Tuesday that AI-generated vulnerability reports…
Multiple vulnerabilities in samtools
Posted by Robert Davies on Oct 27 Multiple vulnerabilities, listed below, have been disclosed in the samtools package. These have all been fixed in a new release 1.25…