CVE-2026-116842: DevilutionX 1.4.0 through 1.5.5 Heap Buffer Overflow via libmpq__archive_dup
DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpqarchivedup routine when opening crafted MPQ archives. Attackers can supply an MPQ archive whose block table count exceeds its hash table count, causing memcpy to overflow the heap during startup and crash the game.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running DevilutionX versions 1.4.0 through 1.5.5 are exposed when the game opens a crafted MPQ archive. The issue occurs during startup.
What does an attacker need to exploit it?
An attacker needs to provide a crafted MPQ archive with a block table count greater than its hash table count and persuade the user to open it. The vector requires local access and user interaction.
What is the expected impact?
The crafted archive causes a heap overflow in libmpq__archive_dup during a memcpy operation. The described result is a game crash, affecting availability; integrity impact is also rated low.
How can I determine whether I am affected?
Check the installed DevilutionX version. Versions from 1.4.0 through 1.5.5 are affected according to the available information.