EUVD-2026-101289

Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader core/string/optimizedtranslation.cpp, OptimizedTranslation::getmessage. Offsets read from the hash table of a crafted .translation resource are used as indices into the bucket table without bounds validation;...

CVE-2026-110736

Godot Engine versions through 4.7.2 are vulnerable to an out-of-bounds read within the optimized translation loader located at core/string/optimized_translation.cpp in the OptimizedTranslation::get_message function. The root cause is a lack of bounds validation when using offsets from a hash tabl...