Follow-up: the fix for this issue has been merged upstream. PR #124699, "Fix heap overflow with invalid string length in binary resources", merged to master on 2026-10-20 (merge commit d9f4c99f0a): https://github.com/godotengine/godot/pull/124699 The patch rejects negative lengths, and lengths beyond the remaining file size, in ResourceLoaderBinary::get_unicode_string and get_ustring, and returns early on a zero length in get_ustring.
The 3.x backport PR #124700 merged on 2026-10-20 with one additional change: parse_utf8 is given the string length, which closes an out-of-bounds read on a file with a valid length and no null terminator. Tomasz Kaye
