DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpqarchivedup routine when opening crafted MPQ archives. Attackers can supply an MPQ archive whose block table count exceeds its hash table count, causing memcpy to overflow the heap during startup and crash the game.

DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpqfilenumberfromhash function that allows attackers to read heap memory via unchecked blocktableindex values. Attackers can place a crafted .mpq archive in the game's data path, such as a mod, to trigger reads past mpqmap and crash the game.