Out-of-Bounds Read Vulnerability in Godot Engine

CVE-2026-110736

What is CVE-2026-110736?

The Godot Engine, up to version 4.7.2, has a vulnerability in its optimized translation loading mechanism. This flaw allows an out-of-bounds read due to improper bounds validation when reading offsets from a crafted .translation file. An attacker can exploit this by providing a malicious translation resource, potentially leading to a crash or the exposure of sensitive information from the process heap when translation lookups are performed. This issue arises specifically when the product loads and performs operations on a specially crafted file, posing a risk for applications utilizing the engine.

References