CVE-2021-26825 Integer overflow in n/a
Integer overflow in Godot Engine allows attackers to execute code or crash the system via crafted TGA image files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-26825?
CVE-2021-26825 is a high-severity vulnerability in n/a, published on 8 Feb 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
An integer overflow issue exists in Godot Engine up to v3.2 that can be triggered when loading specially crafted.TGA image files. The vulnerability exists in ImageLoaderTGA::load_image() function at line: const size_t buffer_size = (tga_header.image_width * tga_header.image_height) * pixel_size; The bug leads to Dynamic stack buffer overflow. Depending on the context of the application, attack vector can be local or remote, and can lead to code execution and/or system crash.
Weakness: CWE-190
Which versions are affected by CVE-2021-26825?
It affects 1 product.
Products include Godotengine Godot Engine.
How do I fix CVE-2021-26825?
Upgrade to a fixed version.
Is CVE-2021-26825 being exploited?
There is no known exploitation of CVE-2021-26825 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2021-26825, GHSA-gp7f-w798-4853, UBUNTU-CVE-2021-26825.