CVE-2026-110736: CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input in godotengine Godot Engine

Godot Engine versions 1.0.0 through 4.7.2 contain an out-of-bounds read in the optimized translation loader component (core/string/optimized_translation.cpp, OptimizedTranslation::get_message). The flaw is due to insufficient validation of indices derived from a hash table in a crafted .translation resource file. Only one sentinel value is rejected, allowing an attacker to supply an index that points beyond the allocated bucket table. This can lead to a crash or disclosure of arbitrary process memory as translated strings during translation lookups. The vulnerability requires loading a malicious translation file and performing string lookups. The vendor does not consider this a security issue within their threat model.

Successful exploitation can cause application crashes or disclosure of process memory contents as translated strings. This could lead to limited information disclosure but does not allow code execution or integrity compromise. The attack requires local or otherwise authorized file access to load a crafted translation resource. The CVSS score is 3.6 (low severity) reflecting low impact and high attack complexity.

No official patch or fix is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor states that this issue is outside their threat model and does not classify it as a security problem. Mitigation involves avoiding loading untrusted or crafted translation resource files. Monitor vendor communications for any future updates or patches.