https://seclists.org/oss-sec/2026/q4/157: Godot 4.x: heap out-of-bounds ad in OptimizedTranslation message lookup
Published Oct 14, 2026
·Updated
Affected Software
1 affected component
Godot Godot
Projects that load an attacker-crafted OptimizedTranslation .translation or .tres resource are exposed when a tr() call performs a lookup through the malformed data. The reported crash is deterministic on stock 64-bit editor and export-template binaries.
The attacker needs to provide a crafted compiled translation resource of the affected type. The resource's hash-table entry and bucket string offset are read without bounds checks during message lookup.
The issue was verified in the official Godot 4.7-stable release build. The report also states that stock 64-bit editor and export-template binaries deterministically fault when the malformed lookup is reached.
Godot 4.7-stable was verified affected, and earlier versions are presumed affected because the loader has existed since 2014. The issue was still unpatched in master, 4.7.2, 4.7.1, and 4.7 as of 2026-10-13.