CVE-2026-116841
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq__file_number_from_hash function that allows attackers to read heap memory via unchecked block_table_index values. Attackers can place a crafted .mpq archive in the game's data path, such as a mod, to trigger reads past mpq_map and crash the game.
Risk Assessment
Remote crash of the game is possible, along with potential information disclosure from process memory.
Recommendation
Update DevilutionX to a version later than 1.5.5 that includes the fix in the libmpq library.
Other vulnerabilities in DevilutionX
Original NVD description (English source)
DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq__file_number_from_hash function that allows attackers to read heap memory via unchecked block_table_index values. Attackers can place a crafted .mpq archive in the game's data path, such as a mod, to trigger reads past mpq_map and crash the game.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS