CVE-2026-110735: CWE-195 Signed to Unsigned Conversion Error in godotengine Godot Engine

Godot Engine versions up to 4.7.2 contain a heap out-of-bounds write vulnerability in the binary resource loader component (core/io/resource_format_binary.cpp, ResourceLoaderBinary::get_unicode_string). The issue arises because a string length is read as a signed 32-bit integer from a resource file and compared with the destination buffer size using a signed comparison. If the length is negative, the buffer resize is skipped, but the negative length is then interpreted as a large unsigned value during the copy operation, causing a heap overflow by copying data beyond the allocated buffer. This vulnerability is triggered when loading a specially crafted binary resource (.res) file. The vendor's position is that this does not constitute a security issue under their threat model since exploitation requires attacker access beyond typical assumptions.

The vulnerability allows a heap out-of-bounds write which could lead to memory corruption. However, the CVSS score is low (2.5) reflecting that exploitation requires local access with high attack complexity and user interaction, and it does not impact confidentiality or availability. The vendor does not consider this a security issue within their threat model, indicating limited practical impact.

No official patch or remediation guidance is provided. The vendor's position is that this issue is not a security concern under their threat model. Users should consider restricting access to resource files and validate inputs if possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.