Cyber ·
Godot 4.x: fix for heap out-of-bounds read in OptimizedTranslation message lookup
Security advisory on a heap out-of-bounds read in OptimizedTranslation message lookup in Godot 4.x, with the fix already merged upstream on 20 October 2026.
Security advisory published on 23 October 2026 about a heap out-of-bounds read in message lookup in OptimizedTranslation, a component of the Godot 4.x engine. The fix has been merged upstream: PR #124701, titled Fix out-of-bounds reads with corrupted OptimizedTranslation data, entered the master branch on 20 October 2026, with merge commit 9e0d5af850. According to the text, the fix validates bucket and string offsets in the new _get_bucket and _get_string helpers, which are used by get_message and get_translated_message_list, and adds input bounds checks to the included code. The item is an automatic translation of content from the oss-sec list, and the original reference is on that list. Relevance: the case shows how corrupted translation data can cause invalid memory reads in game engines and other programs. Rota Nacional does not fix or solve this engineering problem; it belongs to the Godot project. To verify, check the oss-sec list for the stated date, locate the PR by number, and confirm the merge commit in the project history.