{"id":"TECH-202610-unpatched-godot-4-multiplayer-flaw-lets-a-malicious-game-ser","kind":"technique","aliases":[],"related":[],"title":"Unpatched Godot 4 multiplayer flaw lets a malicious game server crash every client that joins with one crafted packet","description":null,"summary":"In Godot Engine 4.0.0 through 4.7.2 and current master, the multiplayer spawn-packet size check (SceneReplicationInterface::on_spawn_receive) computes name_len + sync_len*4 in 32-bit unsigned math. A sync_len of 0x40000000 wraps the product to 0, the check passes, and the engine reads past the packet buffer until the process crashes. A single crafted 27-byte packet from the peer with spawn authority (the server in the default client-server setup, or any peer in a mesh that grants spawn authority) crashes a joining client about one second after it connects, and does it again on every reconnect. Works over ENet and WebSocket, and the game's own code never sees the packet. At risk: games using Godot's standard high-level multiplayer spawning (MultiplayerSpawner) where players can join third-party or community servers, or peer-to-peer meshes. Only a crash (denial of service) is shown; no code execution or data leak is claimed (researcher's CVSS 6.5). The researcher (Tomasz Kaye) confirmed it 5/5 on the official 4.7-stable build and published a PoC on 2026-10-27. First reported publicly as Godot issue #121640 on 2026-07-22. Unpatched as of 2026-10-27, CVE requested. No exploitation in the wild reported.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Godot Engine","fixed":[],"affected":">= 4.0.0, <= 4.7.2","ecosystem":"other"}],"ecosystems":[],"tags":["early-warning","technique"],"not_affected_if":[],"how_to_check":"Find shipped games or projects built on Godot 4.0-4.7.2 that use SceneMultiplayer / MultiplayerSpawner and let clients connect to servers or peers you do not run. Signs of an attack: clients crashing with an access violation (Windows exit code 0xC0000005) in SceneReplicationInterface::on_spawn_receive about one second after joining a server. The trigger is a spawn packet with a huge sync_len (for example 0x40000000). Other indicators: unknown.","fix":"No fixed Godot release yet. Watch issue #121640 and upgrade when a fix lands in a 4.7.x release. Until then, patch the engine yourself: do the bounds check in 64-bit or reject sync_len values larger than the remaining packet size divided by 4, then rebuild your export templates. Let clients join only servers you run or trust (server allowlist or server-identity check), and treat community and peer-to-peer hosts as untrusted.","status":"open","published_at":"2026-10-27T00:00:00+00:00","first_seen_at":"2026-10-28T10:34:31+00:00","triaged_at":"2026-10-28T10:34:31+00:00","updated_at":"2026-10-28T10:34:31+00:00","category":"runtime","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-07':238B '-10':227B,244B '-202610':21A '-22':239B '-27':228B,245B '0':80B '0x40000000':75B '121640':235B '2026':226B,237B,243B '27':99B '32':67B '4':3A,25A,65B '4.0.0':43B '4.7':218B '4.7.2':45B '5/5':214B '6.5':207B 'a':30A 'author':107B,126B 'bit':68B 'buffer':91B 'build':220B 'byte':100B 'check':55B,82B 'claim':203B 'client':13A,114B,130B 'client-serv':113B 'code':154B,197B 'communiti':180B 'comput':60B 'confirm':212B 'connect':136B 'craft':18A,98B 'crash':11A,95B,127B,190B 'current':47B 'cve':246B 'cvss':206B 'data':200B 'default':112B 'denial':191B 'earli':37B 'early-warn':36B 'enet':146B 'engin':42B,86B 'engine':35A 'everi':12A,142B 'execut':198B 'exploit':249B 'first':229B 'flaw':5A,28A 'game':9A,32A,151B,161B 'godot':2A,24A,34A,41B,163B,233B 'grant':124B 'high':167B 'high-level':166B 'issu':234B 'join':15A,129B,175B 'kay':211B 'leak':201B 'len':62B,64B,73B 'let':6A 'lets':29A 'level':168B 'malici':8A 'malicious':31A 'master':48B 'math':70B 'mesh':122B,187B 'multiplay':4A,50B,169B 'multiplayer':27A 'multiplayer-flaw-lets-a-malicious-game-ser':26A 'multiplayerspawn':171B 'name':61B 'never':155B 'offici':217B 'one':17A,132B 'packet':19A,53B,90B,101B,158B 'parti':178B 'pass':83B 'past':88B 'peer':104B,119B,184B,186B 'peer-to-p':183B 'player':173B 'poc':224B 'process':94B 'product':78B 'public':231B 'publish':222B 'read':87B 'receiv':59B 'reconnect':143B 'report':230B,253B 'request':247B 'research':204B,209B 'risk':160B 'scenereplicationinterfac':56B 'second':133B 'see':156B 'ser':33A 'server':10A,109B,115B,181B 'servic':193B 'setup':116B 'shown':195B 'singl':97B 'size':54B 'spawn':52B,58B,106B,125B,170B 'spawn-packet':51B 'stabl':219B 'standard':165B 'sync':63B,72B 'tech':20A 'techniqu':39B 'third':177B 'third-parti':176B 'tomasz':210B 'unpatch':1A,240B 'unpatched':23A 'unpatched-godot':22A 'unsign':69B 'use':162B 'warn':38B 'websocket':148B 'wild':252B 'work':144B 'wrap':76B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"TECH-202610-unpatched-godot-4-multiplayer-flaw-lets-a-malicious-game-ser","url":null,"severity":null,"published_at":"2026-10-27T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-28T10:34:31+00:00","fetched_at":"2026-10-28T10:34:31+00:00","note":null}],"documents":[{"id":10011,"url":"https://www.reddit.com/r/netsec/comments/1xhju55/a_malicious_game_server_can_crash_the_godot/","title":"r/netsec: A malicious game server can crash the Godot clients that join it","kind":"post","source":"reddit","text":"A malicious game server can crash the Godot clients that join it\n\nIn Godot 4.0 and later, in games using the engine's standard spawning setup, a peer with authority over the relevant spawner - by default the server the client joins - can crash that client with one crafted packet. submitted by /u/bitbutter [link] [comments]","published_at":"2026-10-28T09:57:22+00:00","relation":"describes","confidence":null,"note":null},{"id":10035,"url":"https://x.com/_r_netsec/status/2115383913250185486","title":"@_r_netsec: A malicious game server can crash the Godot clients that join it https://t.co/Sb","kind":"post","source":"x","text":"A malicious game server can crash the Godot clients that join it https://t.co/SbkwTS82yA\n\nlikes 0 reposts 1","published_at":"2026-10-28T10:03:21+00:00","relation":"describes","confidence":null,"note":null},{"id":10128,"url":"https://axeghost.offprint.app/a/3myukb53ww723-a-malicious-game-server-can-crash-the-godot-clients-that-join-it","title":"A malicious game server can crash the Godot clients that join it (Tomasz Kaye)","kind":"blog","source":"analyst","text":"Godot 4.0-4.7.2 and master: spawn packet bounds check in SceneReplicationInterface::on_spawn_receive computes name_len + (sync_len*4) in 32-bit unsigned arithmetic; sync_len=0x40000000 wraps to 0, loop reads out of bounds until crash. One crafted 27-byte packet from a peer with spawn authority (the server by default) crashes joining clients ~1s after connect. Confirmed 5/5 on official 4.7-stable. Self-assessed CVSS 6.5 (DoS only, no code execution or disclosure claimed). Unpatched as of 2026-10-27; public issue #121640 open since 2026-07-22. PoC: github.com/bitbutter/godot-security-pocs/tree/main/2026-10-spawn-sync-len-oob","published_at":"2026-10-27T00:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":10129,"url":"https://www.openwall.com/lists/oss-security/2026/10/27/8","title":"oss-security: Godot 4.x remote client crash via multiplayer spawn packet sync_len overflow","kind":"advisory","source":"analyst","text":"Godot 4.0.0 through 4.7.2 and master. Remote DoS: crafted spawn packet sync_len overflow, out-of-bounds read crashes joining clients. Unpatched as of 2026-10-27. Godot issue #121640. CVE requested (CAN-2026-2040954). No code execution or information disclosure claimed.","published_at":"2026-10-27T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}