Vulnerability · Published Oct 27, 2026 · Assigned by VulnCheck
CVE-2026-116842DevilutionX 1.4.0 through 1.5.5 Heap Buffer Overflow via libmpq__archive_dup
Medium 6.1
In plain English
A medium-severity out-of-bounds write in DevilutionX from diasurgical. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.1%top 97.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpq__archive_dup routine when opening crafted MPQ archives. Attackers can supply an MPQ archive whose block table count exceeds its hash table count, causing memcpy to overflow the heap during startup and crash the game.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| diasurgical | DevilutionX | 1.4.0 – through 1.5.5 |
Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
References
- https://github.com/diasurgical/DevilutionX/issues/8758 issue-tracking
- https://github.com/diasurgical/DevilutionX/pull/8482 patch, issue-tracking
- https://github.com/diasurgical/libmpq/blob/b78d66c6fee6a501cc9b95d8556a129c68841b05/libmpq/mpq.c#L505 technical-description
- https://github.com/diasurgical/DevilutionX/blob/7223eeac9e8274fbf665b4de86fda26d3b22c52f/3rdParty/libmpq/CMakeLists.txt technical-description
- https://hackmd.io/@haindpwn/devilutionx-libmpq-hash-block-table-oob technical-description
- VulnCheck Advisory: DevilutionX 1.4.0 through 1.5.5 Heap Buffer Overflow via libmpq__archive_dup third-party-advisory
- https://hackmd.io/@haindpwn/cve-2026-116841-116842-devilutionx-libmpq-hash-block-table-oob exploit