
Cloud Vulnerability DB
A community-led vulnerabilities database
An integer overflow vulnerability (CVE-2021-26825) was discovered in Godot Engine versions up to v3.2. The vulnerability exists in the ImageLoaderTGA::load_image() function when loading specially crafted .TGA image files. The issue was discovered and disclosed in February 2021 (NVD).
The vulnerability stems from an integer overflow in the calculation of buffer size using the formula: const size_t buffer_size = (tga_header.image_width * tga_header.image_height) * pixel_size. This calculation can lead to a dynamic stack buffer overflow. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).
The vulnerability can lead to code execution and/or system crash when exploited. Depending on the application context, the attack vector can be either local or remote (NVD).
The vulnerability requires user interaction to load a malformed TGA image file. The attack complexity is considered low, and no privileges are required to execute the attack (NVD).
A fix for this vulnerability was implemented through a pull request in the Godot Engine repository. The patch addresses the integer overflow issue by adding proper buffer size validation (Godot PR).
Source: This report was generated using AI
Free Vulnerability Assessment
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
"We know that if Wiz identifies something as critical, it actually is."