Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR (.hdr) image decoder (modules/hdr/image_loader_hdr.cpp). The run-length decoding loop expands RLE instructions read from the file into a buffer sized from the ima…

{
                    "defaultStatus": "unknown",
                    "modules": [
                        "HDR image importer"
                    ],
                    "product": "Godot Engine",
                    "programFiles": [
                        "modules/hdr/image_loader_hdr.cpp"
                    ],
                    "programRoutines": [
                        {
                            "name": "ImageLoaderHDR::load_image"
                        }
                    ],
                    "repo": "https://github.com/godotengine/godot",
                    "vendor": "godotengine",
                    "versions": [
                        {
                            "lessThanOrEqual": "4.7.2",
                            "status": "affected",
                            "version": "3.0.0",
                            "versionType": "semver"
                        }
                    ]
                }