CVE-2021-26825

7.8 highEPSS 1.5%

High (7.8) in godotengine godot engine. EPSS 1.5% chance of exploitation in the next 30 days.

An integer overflow issue exists in Godot Engine up to v3.2 that can be triggered when loading specially crafted.TGA image files. The vulnerability exists in ImageLoaderTGA::load_image() function at line: const size_t buffer_size = (tga_header.image_width * tga_header.image_height) * pixel_size; The bug leads to Dynamic stack buffer overflow. Depending on the context of the application, attack vector can be local or remote, and can lead to code execution and/or system crash.

Severity

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
CWE: CWE-190
Published: 2021-02-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

godotengine:godot_engine

References

https://github.com/godotengine/godot/pull/45702
https://github.com/godotengine/godot/pull/45702/files
https://github.com/godotengine/godot/pull/45702
https://github.com/godotengine/godot/pull/45702/files

Check your stack JSON