PT-2021-17151 · Unknown+4 · Godot Engine+4

Hpvb · Published 2021-02-08 · Updated 2025-06-18 · CVE-2021-26826

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Godot Engine versions up to v3.2

Description: A stack overflow issue exists due to improper boundary checks when loading .TGA image files. Depending on the context of the application, the attack vector can be local or remote, and can lead to code execution and/or system crash.

Recommendations: For Godot Engine versions up to v3.2, update to a version that includes the fix for the stack overflow issue caused by improper boundary checks when loading .TGA image files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2025-5969

CVE-2021-26826

OPENSUSE-SU-2024:10813-1

OPENSUSE-SU-2024:12761-1

USN-7579-1

Affected Products

Alt Linux

Debian

Godot Engine

Linuxmint

Ubuntu

References · 19

• https://github.com/godotengine/godot/pull/45701/commits/403e4fd08b0b212e96f53d926e6273e0745eaa5a · Patch
• https://github.com/godotengine/godot/pull/45701 · Patch
• https://ubuntu.com/security/CVE-2021-26826 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-2126 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7579-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12761-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-26826 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10813-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-26826 · Security Note
• https://ubuntu.com/security/CVE-2021-26825 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-26826 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26826 · Security Note
• https://ubuntu.com/security/notices/USN-7579-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-26826 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-26826 · Vendor Advisory