CVE-2026-116842: medium-severity vulnerability in diasurgical DevilutionX
DevilutionX 1.4.0 through 1.5.5 Heap Buffer Overflow via libmpq__archive_dup
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.9epss 0.1%
DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpq__archive_dup routine when opening crafted MPQ archives. Attackers can supply an MPQ archive whose block table count exceeds its hash table count, causing memcpy to overflow the heap during startup and crash the game.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Affected products
diasurgical · DevilutionXpublic PoCs found — 1
cve_referencehackmd.io/@haindpwn/cve-2026-116841-116842-devilutionx-libmpq-hash-block-table-oobunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — diasurgical DevilutionX
In the same product, most dangerous first.
References
https://github.com/diasurgical/DevilutionX/blob/7223eeac9e8274fbf665b4de86fda26d3b22c52f/3rdParty/libmpq/CMakeLists.txthttps://github.com/diasurgical/DevilutionX/issues/8758https://github.com/diasurgical/DevilutionX/pull/8482https://github.com/diasurgical/libmpq/blob/b78d66c6fee6a501cc9b95d8556a129c68841b05/libmpq/mpq.c#L505https://hackmd.io/@haindpwn/cve-2026-116841-116842-devilutionx-libmpq-hash-block-table-oobhttps://hackmd.io/@haindpwn/devilutionx-libmpq-hash-block-table-oobhttps://www.vulncheck.com/advisories/devilutionx-1.4.0-through-1.5.5-heap-buffer-overflow-via-libmpq-archive-dup