godotengine Godot Engine up to 4.7.2 optimized translation loader optimized_translation.cpp get_message out-of-bounds ⚔ [Disputed]

Summaryinfo

A vulnerability was found in godotengine Godot Engine up to 4.7.2. It has been rated as problematic. The affected element is the function OptimizedTranslation::get_message of the file core/string/optimized_translation.cpp of the component optimized translation loader. Performing a manipulation results in out-of-bounds. This vulnerability was named CVE-2026-110736. The attack needs to be approached locally. There is no available exploit. It is still unclear if this vulnerability genuinely exists.

Detailsinfo

A vulnerability was found in godotengine Godot Engine up to 4.7.2. It has been classified as problematic. This affects the function OptimizedTranslation::get_message of the file core/string/optimized_translation.cpp of the component optimized translation loader. The manipulation with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader (core/string/optimized_translation.cpp, OptimizedTranslation::get_message). Offsets read from the hash table of a crafted .translation resource are used as indices into the bucket table without bounds validation; only a single sentinel value is rejected. A crafted file can point an index far past the allocated buffer. Depending on the values, the result is a crash, or a string lookup (tr()) returns raw bytes from elsewhere in the process heap as the translated string, disclosing process memory. The defect is reached when the product or an exported game loads and performs lookups in a crafted translation file. NOTE: the Supplier's position is that the research has identified "no security issues" because the required attacker access is outside of the current Godot Engine threat model.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-110736 since 10/14/2026. The exploitability is told to be easy. Attacking locally is a requirement. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

The real existence of this vulnerability is still doubted at the moment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-101289). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• godotengine

Name

• Godot Engine

Version

• 4.7.0
• 4.7.1
• 4.7.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion