Follow-up: the fix for this issue has been merged upstream. PR #124697, "Fix out-of-bounds write when loading corrupt HDR images", merged to master on 2026-10-20 (merge commit aef8e1f55a): https://github.com/godotengine/godot/pull/124697 The patch rejects non-positive and oversized image dimensions and bounds each RLE run and dump against the remaining scanline width.
The PR body cites CVE-2026-110734 and states the vendor's position on the bug: "We don't consider it severe, but it's still a bug that should be fixed." Tomasz Kaye
