CVE-2026-116841: DevilutionX 1.4.0 through 1.5.5 Out-of-Bounds Read via libmpq Hash Table Lookup
DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpqfilenumberfromhash function that allows attackers to read heap memory via unchecked blocktableindex values. Attackers can place a crafted .mpq archive in the game's data path, such as a mod, to trigger reads past mpqmap and crash the game.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running DevilutionX versions 1.4.0 through 1.5.5 are exposed when the game loads an attacker-controlled .mpq archive from its data path, including an archive supplied as a mod.
What does an attacker need to exploit it?
The attacker needs to cause a crafted .mpq archive with unchecked block_table_index values to be placed in the game's data path. User interaction is required to load the malicious archive.
What is the likely impact?
The crafted archive can make the game read beyond the mpq_map heap allocation and crash. The supplied data describes heap-memory reads and denial of availability; it does not describe confidentiality or integrity impact.
How can I tell whether I may be affected?
Check whether the installed DevilutionX version is between 1.4.0 and 1.5.5 and whether it loads .mpq archives from mods or other untrusted sources in its data path.