A crafted .translation resource can trigger an out‑of‑bounds read in Godot Engine’s optimized translation loader. The loader interprets offsets from a hash table as indices into a bucket table without validating that they fall within the allocated array. An attacker may supply an offset that lies far beyond the buffer boundary, causing the engine to read arbitrary bytes from the process heap. Depending on the data, this can either crash the game or return corrupted memory contents as a translated string, effectively leaking process memory.

Affected versions include Godot Engine 4.7.2 and earlier. The flaw is present in the core/string/optimized_translation.cpp module. It can be triggered when the engine or an exported game loads a malicious .translation file. Users running 4.7.2 or older, or running older builds that have not received the patch, are vulnerable.

The CVSS score of 3.6 designates a low severity vulnerability. The EPSS score of < 1 % suggests that exploitation of this weakness is unlikely and there are no recorded incidents. The issue is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a fabricated .translation file that the engine or a game will load; this is outside the typical threat model and would not be viable for remote exploitation without direct user interaction. The vendor has stated that “no security issues” are identified within the current threat model, reinforcing the expectation that this vulnerability is not exploitable in most operational contexts.