Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader (core/string/optimized_translation.cpp, OptimizedTranslation::get_message). Offsets read from the hash table of a crafted .translation resource are use…

{
                    "defaultStatus": "unknown",
                    "modules": [
                        "Translation system"
                    ],
                    "product": "Godot Engine",
                    "programFiles": [
                        "core/string/optimized_translation.cpp"
                    ],
                    "programRoutines": [
                        {
                            "name": "OptimizedTranslation::get_message"
                        }
                    ],
                    "repo": "https://github.com/godotengine/godot",
                    "vendor": "godotengine",
                    "versions": [
                        {
                            "lessThanOrEqual": "4.7.2",
                            "status": "affected",
                            "version": "1.0.0",
                            "versionType": "semver"
                        }
                    ]
                }