{"id":"CVE-2021-26826","aliases":["DEBIAN-CVE-2021-26826","EUVD-2021-13611","GHSA-fcrr-6fjg-7jpj","UBUNTU-CVE-2021-26826","USN-7579-1","openSUSE-SU-2024:10813-1","openSUSE-SU-2024:12761-1"],"status":"published","title":"A stack overflow issue exists in Godot Engine up to v3.2 and is caused by improper boundary...","description":"A stack overflow issue exists in Godot Engine up to v3.2 and is caused by improper boundary checks when loading .TGA image files. Depending on the context of the application, attack vector can be local or remote, and can lead to code execution and/or system crash.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01598,"percentile":0.76113,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2021-02-08T14:55:24Z","modified":"2026-10-23T18:02:52Z","fixes":[{"ecosystem":"Debian:13","package":"godot","fixed_in":["3.5.1-stable-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"godot","fixed_in":["3.5.1-stable-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"godot","fixed_in":["3.2-stable-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"godot","fixed_in":["3.2.3-stable-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"godot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.3-stable-1","3.5.1-stable-1","3.5.1-stable-2","3.5.2-stable-1","3.5.2-stable-2","3.6+ds-1","3.6+ds-2","4.4.1+ds-1","4.4.1+ds-1.1","4.5.1+ds-1","4.6.3+ds-1","4.6.3+ds-2"]},{"source":"osv","ecosystem":"Debian:13","package":"godot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-stable-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"godot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-stable-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"godot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2-stable-2ubuntu0.1~esm1"}]}],"versions":["3.0.6-2build1","3.0.6-2build2","3.2-stable-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"godot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-stable-1ubuntu0.1~esm1"}]}],"versions":["3.2.3-stable-1","3.2.3-stable-1build1","3.2.3-stable-1build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"godot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.6.3+ds-1","4.6.3+ds-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"godot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2-stable-2ubuntu0.1~esm1"}]}],"versions":["3.0.6-2build1","3.0.6-2build2","3.2-stable-2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"godot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-stable-1ubuntu0.1~esm1"}]}],"versions":["3.2.3-stable-1","3.2.3-stable-1build1","3.2.3-stable-1build2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"godot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-stable-2ubuntu0.24.04.1~esm1"}]}],"versions":["3.5.2-stable-2","3.5.2-stable-2build1","3.5.2-stable-2build3","3.5.2-stable-2build4"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"godot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-1.3"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"godot3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-1.1"}]}],"bundled":2}],"products":[{"vendor":"godotengine","product":"godot_engine"}],"references":[{"url":"https://github.com/godotengine/godot/pull/45701","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/godotengine/godot/pull/45701/commits/403e4fd08b0b212e96f53d926e6273e0745eaa5a","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26826"},{"url":"https://github.com/advisories/GHSA-fcrr-6fjg-7jpj"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-26826","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-26826","tags":["report"]},{"url":"https://github.com/godotengine/godot/commit/403e4fd08b0b212e96f53d926e6273e0745eaa5a","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-26826","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7579-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-2126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-26825","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-26825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-26826","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-26826","description":"A stack overflow issue exists in Godot Engine up to v3.2 and is caused by improper boundary checks when loading .TGA image files. Depending on the context of the application, attack vector can be local or remote, and can lead to code execution and/or system crash.","status":"published","published":"2021-02-08T14:55:24Z","modified":"2024-08-03T20:33:40.974Z","updated_at":"2026-11-02T14:32:57.368269Z"}],"euvd":[{"id":"EUVD-2021-13611","description":"A stack overflow issue exists in Godot Engine up to v3.2 and is caused by improper boundary checks when loading .TGA image files. Depending on the context of the application, attack vector can be local or remote, and can lead to code execution and/or system crash.","status":"published","published":"2021-02-08T14:55:24Z","modified":"2024-08-03T20:33:40Z","updated_at":"2026-11-03T03:24:50.84326Z"}],"ghsa":[{"id":"GHSA-fcrr-6fjg-7jpj","title":"A stack overflow issue exists in Godot Engine up to v3.2 and is caused by improper boundary...","description":"A stack overflow issue exists in Godot Engine up to v3.2 and is caused by improper boundary checks when loading .TGA image files. Depending on the context of the application, attack vector can be local or remote, and can lead to code execution and/or system crash.","status":"published","published":"2022-05-24T17:41:21Z","modified":"2023-01-29T05:05:17Z","cwes":["CWE-787"],"updated_at":"2026-11-02T14:45:45.423268Z"}],"nvd":[{"id":"CVE-2021-26826","description":"A stack overflow issue exists in Godot Engine up to v3.2 and is caused by improper boundary checks when loading .TGA image files. Depending on the context of the application, attack vector can be local or remote, and can lead to code execution and/or system crash.","status":"published","published":"2021-02-08T15:15:12.397Z","modified":"2026-06-17T03:43:49.633Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:06:49.660551Z"}],"osv":[{"id":"CVE-2021-26826","description":"A stack overflow issue exists in Godot Engine up to v3.2 and is caused by improper boundary checks when loading .TGA image files. Depending on the context of the application, attack vector can be local or remote, and can lead to code execution and/or system crash.","status":"published","published":"2021-02-08T15:15:12.397Z","modified":"2026-10-20T10:54:34.76428526Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:18.778776Z"},{"id":"DEBIAN-CVE-2021-26826","description":"A stack overflow issue exists in Godot Engine up to v3.2 and is caused by improper boundary checks when loading .TGA image files. Depending on the context of the application, attack vector can be local or remote, and can lead to code execution and/or system crash.","status":"published","published":"2021-02-08T15:15:12.397Z","modified":"2026-10-23T18:02:52.050572609Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"UBUNTU-CVE-2021-26826","description":"A stack overflow issue exists in Godot Engine up to v3.2 and is caused by improper boundary checks when loading .TGA image files. Depending on the context of the application, attack vector can be local or remote, and can lead to code execution and/or system crash.","status":"published","published":"2021-02-08T15:15:00Z","modified":"2026-10-17T12:57:11.858798788Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"openSUSE-SU-2024:10813-1","title":"godot-3.3.3-1.3 on GA media","description":"These are all security issues fixed in the godot-3.3.3-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:22:54.567501Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:12761-1","title":"godot3-3.5.1-1.1 on GA media","description":"These are all security issues fixed in the godot3-3.5.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:55:35.21712Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"USN-7579-1","title":"godot vulnerabilities","description":"It was discovered that the Godot Engine did not properly handle\ncertain malformed WebM media files. If the Godot Engine opened a\nspecially crafted WebM file, a remote attacker could cause a denial\nof service, or possibly execute arbitrary code. (CVE-2019-2126)\n\nIt was discovered that the Godot Engine did not properly handle\ncertain malformed TGA image files. If the Godot Engine opened a\nspecially crafted TGA image file, a remote attacker could cause\na denial of service, or possibly execute arbitrary code. This\nissue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.\n(CVE-2021-26825, CVE-2021-26826)","status":"published","published":"2025-06-18T15:50:49Z","modified":"2026-04-27T18:03:59.894432Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}