CVE-2026-110736

Godot Engine through 4.7.2 has an out-of-bounds read in OptimizedTranslation::get_message (core/string/optimized_translation.cpp) when loading an optimized translation resource. Offsets taken from the hash table of a crafted .translation file are used as indices into the bucket table without bounds checks; only a single sentinel value is rejected, so an index can point far past the allocated buffer. Depending on those values, a lookup via tr() can crash the process or return raw bytes from elsewhere on the process heap as the translated string, disclosing process memory. The bug is reached when the editor or an exported game loads the crafted file and performs a message lookup. It is not listed in CISA KEV, no public proof-of-concept is known, and the supplier’s position is that this falls outside the engine’s current threat model because of the access required.

What to do: Do not load or ship untrusted .translation resources, and treat translation files as untrusted input in the editor and in exported games. Update Godot Engine past 4.7.2 when the project publishes a build that adds bounds checks in OptimizedTranslation::get_message; no fixed version is named in the advisory. Until then, avoid opening third-party translation packs and rebuild games after a patched engine release.