CVE-2026-110735

Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader core/io/resourceformatbinary.cpp, ResourceLoaderBinary::getunicodestring. A string length is read from the resource file into a signed 32-bit integer and compared against the destination buffer size with a...