Medium severity6.1NVD Advisory· Published Oct 27, 2026
CVE-2026-116842
CVE-2026-116842
Description
DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpq__archive_dup routine when opening crafted MPQ archives. Attackers can supply an MPQ archive whose block table count exceeds its hash table count, causing memcpy to overflow the heap during startup and crash the game.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: 1.4.0 - 1.5.5
Patches
Vulnerability mechanics
References
6- github.com/diasurgical/DevilutionX/blob/7223eeac9e8274fbf665b4de86fda26d3b22c52f/3rdParty/libmpq/CMakeLists.txtnvd
- github.com/diasurgical/DevilutionX/issues/8758nvd
- github.com/diasurgical/DevilutionX/pull/8482nvd
- github.com/diasurgical/libmpq/blob/b78d66c6fee6a501cc9b95d8556a129c68841b05/libmpq/mpq.cnvd
- hackmd.io/@haindpwn/devilutionx-libmpq-hash-block-table-oobnvd
- www.vulncheck.com/advisories/devilutionx-1.4.0-through-1.5.5-heap-buffer-overflow-via-libmpq-archive-dupnvd
News mentions
0No linked articles in our index yet.