Follow-up: the fix for this issue has been merged upstream. PR #124701, "Fix out-of-bounds reads with corrupt OptimizedTranslation data", merged to master on 2026-10-20 (merge commit 9e0d5af850): https://github.com/godotengine/godot/pull/124701 The patch validates bucket and string offsets in new _get_bucket and _get_string helpers, used by both get_message and get_translated_message_list, and adds input bounds checks to the bundled smaz decompressor.
The 3.x backport PR #124703 applies the same validation to PHashTranslation and merged on 2026-10-22. Tomasz Kaye
