CVE-2026-116842EUVD-2026-110573GHSA-G75X-VCW6-3M3F
DevilutionX 1.4.0 through 1.5.5 Heap Buffer Overflow via libmpq__archive_dup
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fix or patch referenced
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
DevilutionX, an open-source port of the classic Diablo game, is affected when it opens a specially crafted MPQ archive, which can overflow a memory buffer and crash the game. The flaw lies in its bundled libmpq library, so an attacker could use a malicious game data file to disrupt the game during startup.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpq__archive_dup routine when opening crafted MPQ archives. Attackers can supply an MPQ archive whose block table count exceeds its hash table count, causing memcpy to overflow the heap during startup and crash the game.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- diasurgical DevilutionX
From 1.4.0 · through 1.5.5