CVE-2021-26825
CVE-2021-26825
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An integer overflow issue exists in Godot Engine up to v3.2 that can be triggered when loading specially crafted.TGA image files. The vulnerability exists in ImageLoaderTGA::load_image() function at line: const size_t buffer_size = (tga_header.image_width * tga_header.image_height) * pixel_size; The bug leads to Dynamic stack buffer overflow. Depending on the context of the application, attack vector can be local or remote, and can lead to code execution and/or system crash.
CVSS 7.8 · High · EPSS 1.5% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
godot Debian:12
- Versions
- 3.2.3-stable-1
- 3.5.1-stable-1
- 3.5.1-stable-2
- 3.5.2-stable-1
- 3.5.2-stable-2
- 3.6+ds-1
- 3.6+ds-2
- 4.4.1+ds-1
- 4.4.1+ds-1.1
- 4.5.1+ds-1
- 4.6.3+ds-1
- 4.6.3+ds-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
godot Debian:13
- Affected ranges
- ECOSYSTEM: < 3.5.1-stable-1
Update to 3.5.1-stable-1
godot Debian:14
- Affected ranges
- ECOSYSTEM: < 3.5.1-stable-1
Update to 3.5.1-stable-1
godot Ubuntu:Pro:20.04:LTS
- Versions
- 3.0.6-2build1
- 3.0.6-2build2
- 3.2-stable-2
- Affected ranges
- ECOSYSTEM: < 3.2-stable-2ubuntu0.1~esm1
Update to 3.2-stable-2ubuntu0.1~esm1
godot Ubuntu:Pro:22.04:LTS
- Versions
- 3.2.3-stable-1
- 3.2.3-stable-1build1
- 3.2.3-stable-1build2
- Affected ranges
- ECOSYSTEM: < 3.2.3-stable-1ubuntu0.1~esm1
Update to 3.2.3-stable-1ubuntu0.1~esm1
godot Ubuntu:26.10
- Versions
- 4.6.3+ds-1
- 4.6.3+ds-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published