CVE-2018-1000224: Godotengine Godot

High severity, CVSS 7.5. EPSS: 3.8% chance of exploitation in the next 30 days.

Godot Engine version All versions prior to 2.1.5, all 3.0 versions prior to 3.0.6. contains a Signed/unsigned comparison, wrong buffer size chackes, integer overflow, missing padding initialization vulnerability in (De)Serialization functions (core/io/marshalls.cpp) that can result in DoS (packet of death), possible leak of uninitialized memory. This attack appear to be exploitable via A malformed packet is received over the network by a Godot application that uses built-in serialization (e.g. game server, or game client). Could be triggered by multiplayer opponent. This vulnerability appears to have been fixed in 2.1.5, 3.0.6, master branch after commit feaf03421dda0213382b51aff07bd5a96b29487b.

Affected products

• Godotengine Godot: before 2.1.5 (fixed in 2.1.5); from 3.0.0, before 3.0.6 (fixed in 3.0.6)

Published 2018-08-20. Last modified 2026-06-17.