CVE catalog
CVE-2018-1000224
godot: CVE-2018-1000224
- Severity
- Low
- Source
- [NVD] · [CVE record]
- EPSS
- 3.79% · Oct 25, 2026
Godot Engine version All versions prior to 2.1.5, all 3.0 versions prior to 3.0.6. contains a Signed/unsigned comparison, wrong buffer size chackes, integer overflow, missing padding initialization vulnerability in (De)Serialization functions (core/io/marshalls.cpp) that can result in DoS (packet of death), possible leak of uninitialized memory. This attack appear to be exploitable via A malformed packet is received over the network by a Godot application that uses built-in serialization (e.g. game server, or game client). Could be triggered by multiplayer opponent. This vulnerability appears to have been fixed in 2.1.5, 3.0.6, master branch after commit feaf03421dda0213382b51aff07bd5a96b29487b.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | godot | sid | 4.6.3+ds-2 | not affected |
| Debian | godot | forky | 4.6.3+ds-2 | not affected |
| Debian | godot | trixie | 3.6+ds-2 | not affected |
| Debian | godot | bookworm | 3.2.3-stable-1 | not affected |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | godot | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | godot | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | godot | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | godot | source | bookworm | Not affected | unimportant | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [godot3]Not affected
Source package: [godot]
Details (2)
3.2.3-stable-1+b2· arm64 · bookwormNot affected
dsa · godot · debian · bookworm
3.2.3-stable-1+b3· amd64 · bookwormNot affected
dsa · godot · debian · bookworm
- [godot3-runner]Not affected
Source package: [godot]
Details (2)
3.2.3-stable-1+b2· arm64 · bookwormNot affected
dsa · godot · debian · bookworm
3.2.3-stable-1+b3· amd64 · bookwormNot affected
dsa · godot · debian · bookworm
- [godot3-server]Not affected
Source package: [godot]
Details (2)
3.2.3-stable-1+b2· arm64 · bookwormNot affected
dsa · godot · debian · bookworm
3.2.3-stable-1+b3· amd64 · bookwormNot affected
dsa · godot · debian · bookworm
Observed: