---
id: "TECH-202610-unpatched-godot-4-multiplayer-flaw-lets-a-malicious-game-ser"
kind: "technique"
aliases: []
title: "Unpatched Godot 4 multiplayer flaw lets a malicious game server crash every client that joins with one crafted packet"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Godot Engine", "fixed": [], "affected": ">= 4.0.0, <= 4.7.2", "ecosystem": "other"}]
ecosystems: []
tags: ["early-warning", "technique"]
not_affected_if: []
published_at: "2026-10-27T00:00:00+00:00"
first_seen_at: "2026-10-28T10:34:31+00:00"
updated_at: "2026-10-28T10:34:31+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-28T10:34:31+00:00"}]
---

# Unpatched Godot 4 multiplayer flaw lets a malicious game server crash every client that joins with one crafted packet

In Godot Engine 4.0.0 through 4.7.2 and current master, the multiplayer spawn-packet size check (SceneReplicationInterface::on_spawn_receive) computes name_len + sync_len*4 in 32-bit unsigned math. A sync_len of 0x40000000 wraps the product to 0, the check passes, and the engine reads past the packet buffer until the process crashes. A single crafted 27-byte packet from the peer with spawn authority (the server in the default client-server setup, or any peer in a mesh that grants spawn authority) crashes a joining client about one second after it connects, and does it again on every reconnect. Works over ENet and WebSocket, and the game's own code never sees the packet. At risk: games using Godot's standard high-level multiplayer spawning (MultiplayerSpawner) where players can join third-party or community servers, or peer-to-peer meshes. Only a crash (denial of service) is shown; no code execution or data leak is claimed (researcher's CVSS 6.5). The researcher (Tomasz Kaye) confirmed it 5/5 on the official 4.7-stable build and published a PoC on 2026-10-27. First reported publicly as Godot issue #121640 on 2026-07-22. Unpatched as of 2026-10-27, CVE requested. No exploitation in the wild reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- other:Godot Engine affected >= 4.0.0, <= 4.7.2 fixed ?

## How to check

Find shipped games or projects built on Godot 4.0-4.7.2 that use SceneMultiplayer / MultiplayerSpawner and let clients connect to servers or peers you do not run. Signs of an attack: clients crashing with an access violation (Windows exit code 0xC0000005) in SceneReplicationInterface::on_spawn_receive about one second after joining a server. The trigger is a spawn packet with a huge sync_len (for example 0x40000000). Other indicators: unknown.

## Fix

No fixed Godot release yet. Watch issue #121640 and upgrade when a fix lands in a 4.7.x release. Until then, patch the engine yourself: do the bounds check in 64-bit or reject sync_len values larger than the remaining packet size divided by 4, then rebuild your export templates. Let clients join only servers you run or trust (server allowlist or server-identity check), and treat community and peer-to-peer hosts as untrusted.

## Timeline

- 2026-10-28T10:34:31+00:00 analyst

## Documents

- [describes] r/netsec: A malicious game server can crash the Godot clients that join it https://www.reddit.com/r/netsec/comments/1xhju55/a_malicious_game_server_can_crash_the_godot/
- [describes] @_r_netsec: A malicious game server can crash the Godot clients that join it https://t.co/Sb https://x.com/_r_netsec/status/2115383913250185486
- [describes] A malicious game server can crash the Godot clients that join it (Tomasz Kaye) https://axeghost.offprint.app/a/3myukb53ww723-a-malicious-game-server-can-crash-the-godot-clients-that-join-it
- [describes] oss-security: Godot 4.x remote client crash via multiplayer spawn packet sync_len overflow https://www.openwall.com/lists/oss-security/2026/10/27/8

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_