Unpatched Godot DTLS flaw lets one unauthenticated UDP datagram overflow the heap and crash Godot game servers or clients

In Godot Engine, the DTLS receive callback (PacketPeerMbedDTLS::bio_recv, modules/mbedtls/packet_peer_mbed_dtls.cpp) ignores the buffer size mbedTLS gives it (16,765 bytes in 4.7) and copies the whole UDP datagram (up to 65,507 bytes). This happens on the first handshake message, before any certificate check or login. One datagram sent from a plain UDP socket, with no account and no Godot tooling, writes attacker-chosen bytes past the end of a heap buffer. The researcher (axeghost, author of the game Axe Ghost) confirmed this with AddressSanitizer and on official 4.7-stable Windows exports: a community-hosted server using UDPServer + DTLSServer died at the join in 20 of 21 runs, and a player joining a hostile server died as well. In 2 of 8 runs an indirect call read attacker-overwritten memory. Code execution and an info leak were not shown. The researcher scores it CVSS 9.8 (worst case) or 7.5 (demonstrated crash only). At risk: games that turn on Godot's optional DTLS encryption for UDP/ENet multiplayer. Plain UDP and Steam networking are not affected. Per the source, affected from 3.2.2 (June 2020) through 4.7.2 and master (4.8-beta) as of 2026-10-27. Reported privately to Godot on 2026-09-26 with no reply. Published early, on 2026-10-27. Unpatched, no CVE yet, no exploitation in the wild reported.

Summary written from the sources below. Check the originals before acting.