CVE-2026-116842

MediumCVSS 6.1

Published: 27/10/2026(UTC)Updated: 31/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

3th percentile - higher than 3% of all known CVEs

Summary

DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpq__archive_dup routine when opening crafted MPQ archives. Attackers can supply an MPQ archive whose block table count exceeds its hash table count, causing memcpy to overflow the heap during startup and crash the game.

Risk Assessment

Remote crash of the application is possible, and under favorable conditions potential code execution in the game process context.

Recommendation

Update DevilutionX to a version later than 1.5.5 that includes the fix in the libmpq library.

Other vulnerabilities in DevilutionX

CVE-2026-116841Medium
DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq__file_number_from_hash function that allows attackers to read heap memory via unchecked block_table_index values. Attackers can place a crafted .mpq archive in the game's data path, such as a mod, to trigger reads past mpq_map and crash the game.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS