Unpatched Godot 4 multiplayer flaw lets a malicious game server crash every client that joins with one crafted packet

In Godot Engine 4.0.0 through 4.7.2 and current master, the multiplayer spawn-packet size check (SceneReplicationInterface::on_spawn_receive) computes name_len + sync_len*4 in 32-bit unsigned math. A sync_len of 0x40000000 wraps the product to 0, the check passes, and the engine reads past the packet buffer until the process crashes. A single crafted 27-byte packet from the peer with spawn authority (the server in the default client-server setup, or any peer in a mesh that grants spawn authority) crashes a joining client about one second after it connects, and does it again on every reconnect. Works over ENet and WebSocket, and the game's own code never sees the packet. At risk: games using Godot's standard high-level multiplayer spawning (MultiplayerSpawner) where players can join third-party or community servers, or peer-to-peer meshes. Only a crash (denial of service) is shown; no code execution or data leak is claimed (researcher's CVSS 6.5). The researcher (Tomasz Kaye) confirmed it 5/5 on the official 4.7-stable build and published a PoC on 2026-10-27. First reported publicly as Godot issue #121640 on 2026-07-22. Unpatched as of 2026-10-27, CVE requested. No exploitation in the wild reported.

Summary written from the sources below. Check the originals before acting.