Read the docs
TI-2026-74175 Aliases CVE-2026-110736GHSA-qf43-7r7c-mf8f

Out-of-bounds read in Godot Engine translation loader

Priority MEDIUM 50CWE-1285Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · None · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Godot Engine from 1.0.0 through 4.7.2 has an out-of-bounds read in its optimized translation loader. The loader uses offsets from a crafted .translation file as bucket indices without bounds checks (CWE-1285). An attacker who gets a user to load such a file can crash the product or read process heap memory through a translation lookup. The supplier says the attacker access required is outside its threat model.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader (core/string/optimized_translation.cpp, OptimizedTranslation::get_message). Offsets read from the hash table of a crafted .translation resource are used as indices into the bucket table without bounds validation; only a single sentinel value is rejected. A crafted file can point an index far past the allocated buffer. Depending on the values, the result is a crash, or a string lookup (tr()) returns raw bytes from elsewhere in the process heap as the translated string, disclosing process memory. The defect is reached when the product or an exported game loads and performs lookups in a crafted translation file. NOTE: the Supplier's position is that the research has identified "no security issues" because the required attacker access is outside of the current Godot Engine threat model.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00205 10th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
godotengineGodot Engine1.0.0 – 4.7.2—No fix listedCNA
  • Godot Engine Vendorgodotengine Affected 1.0.0 – 4.7.2 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Godot Engine.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-15 Threatist record created from CVE-2026-110736
  2. 2026-10-15 CISA SSVC decision points changed
  3. 2026-10-15 Priority changed: LOW → MEDIUM
  4. 2026-10-16 Alias added: GHSA-qf43-7r7c-mf8f
  5. 2026-11-07 Affected versions changed · Red Hat
  6. 2026-11-07 CVSS score added · Red Hat

References

Other 2

  • TI-2019-07395 In Godot through 3.1, remote code execution is possible due to the deserialization policy not being applied correctly. CVSS 3.0CRITICAL 9.8
  • TI-2018-15869 Godot Engine version All versions prior to 2.1.5, all 3.0 versions prior to 3.0.6. CVSS 3.0HIGH 7.5
  • TI-2021-08451 A stack overflow issue exists in Godot Engine up to v3.2 and is caused by improper… CVSS 3.1HIGH 7.8
  • TI-2021-08450 An integer overflow issue exists in Godot Engine up to v3.2 that can be triggered when… CVSS 3.1HIGH 7.8
  • TI-2026-74162 Heap out-of-bounds write in Godot Engine binary resource loader CVSS 3.1LOW 2.5
  • TI-2026-74161 Heap out-of-bounds write in Godot Engine HDR image decoder CVSS 3.1LOW 2.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences