Posted by Tomasz Kaye on Oct 23 Follow-up: the fix for this issue has been merged upstream. PR #124701, "Fix out-of-bounds reads with corrupt OptimizedTranslation data", merged to master on 2026-10-20 (merge commit 9e0d5af850): https://github.com/godotengine/godot/pull/124701 The patch validates bucket and string offsets in new _get_bucket and _get_string helpers, used by both get_message and get_translated_message_list, and adds input bounds checks to the bundled...

Read the full article at oss-security →