Godot Engine CVE-2026-110736

Exploitation requires the attacker to get a crafted .translation resource file loaded by the Godot editor or an exported Godot game, after which a string lookup (tr()) must be performed against it to trigger the out-of-bounds read in OptimizedTranslation::get_message. Limiting factors: the attacker needs a path to deliver an untrusted translation file into the project/game (local access, no remote network vector), user interaction is required to load the resource, and reliable disclosure of meaningful heap contents depends on process memory layout (reflected as AC:H) - a crash is easier to achieve than useful memory leakage. The vendor further considers loading untrusted resource files to be outside Godot's security boundary, so default/intended usage does not expose this path.

All signals point to genuinely low real-world risk despite this being a memory-safety/information-disclosure flaw. The NVD CVSS 3.1 base score is 3.6 (Low) with vector AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L: exploitation is local (the malicious .translation file must be loaded by the engine/game), requires user interaction, has high attack complexity (meaningful heap disclosure depends on process memory layout, not just triggering the OOB read), and yields only limited confidentiality and availability impact (partial heap leak via tr() or a crash). No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit code is identified - only a third-party research writeup and an upstream GitHub issue. Critically, the Supplier (Godot) explicitly disputes this as a security issue, stating the required attacker access (getting a victim to load an untrusted/crafted resource file) is outside the engine's current threat model. This is therefore a low-priority, disputed, low-CVSS issue rather than an urgent threat; it matters mainly to pipelines that load untrusted .translation files (e.g. user-generated mods or localization packs). No conflicting signals between CVSS and description - both consistently indicate local, interaction-dependent access.

An attacker distributes a crafted .translation resource - for example as a mod, localization pack, or downloadable game asset - to a developer or player. When the Godot editor or an exported game loads that file and performs a string lookup via tr(), the unvalidated offset/index drives an out-of-bounds read that either crashes the process or returns raw heap bytes as the 'translated' string, disclosing process memory. No public exploit code is identified; a third-party research writeup documents the bug.