Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

Godot 4.x: heap out-of-bounds read in OptimizedTranslation message lookup

oss-security ()1
Read at seclists.org
AI summary · grok-4.7-buildSummaries by Vani AI

Unpatched Godot 4.x heap out-of-bounds read affects OptimizedTranslation parsing of untrusted files.

An oss-security post describes a heap out-of-bounds read in Godot 4's OptimizedTranslation::get_message path, one of three memory-safety bugs in untrusted-file parsers disclosed on 21 September 2026. Godot 4.7-stable is verified affected, earlier versions are presumed affected, and the loader has existed since 2014. As of 13 October 2026, master and the 4.7, 4.7.1, and 4.7.2 lines remained unpatched. No CVE or observed exploitation is stated.

Key facts
  • Heap out-of-bounds read affects Godot OptimizedTranslation message lookup.
  • Godot 4.7-stable is verified affected; earlier versions are presumed affected.
  • Disclosed on 21 September 2026 and still unpatched as of 13 October 2026.
  • The loader dates to 2014 and is one of three disclosed parser bugs.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
godotmemory-safetyheap-oobout-of-bounds-readuntrusted-filegame-engine
Vendors
Godot
Products
Godot
Organizations
Godot

From the original article

Posted by Tomasz Kaye on Oct 14 Three memory-safety bugs in Godot 4's untrusted-file parsers were publicly disclosed on 2026-09-21 [1]. This thread covers the OptimizedTranslation bug. Affected versions: Godot 4.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.