CVE-2026-116842 | BDVDB-2026-396456 Detail
diasurgicalDevilutionX
Description#
DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpq__archive_dup routine when opening crafted MPQ archives. Attackers can supply an MPQ archive whose block table count exceeds its hash table count, causing memcpy to overflow the heap during startup and crash the game.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact low, availability impact high. Attack vector: local.
Weaknesses#
- CWE-787 Out-of-bounds Write
References#
- https://github.com/diasurgical/DevilutionX/issues/8758
- https://github.com/diasurgical/DevilutionX/pull/8482
- https://github.com/diasurgical/libmpq/blob/b78d66c6fee6a501cc9b95d8556a129c68841b05/libmpq/mpq.c#L505
- https://github.com/diasurgical/DevilutionX/blob/7223eeac9e8274fbf665b4de86fda26d3b22c52f/3rdParty/libmpq/CMakeLists.txt
- https://hackmd.io/@haindpwn/devilutionx-libmpq-hash-block-table-oob
- https://www.vulncheck.com/advisories/devilutionx-1.4.0-through-1.5.5-heap-buffer-overflow-via-libmpq-archive-dup
- https://hackmd.io/@haindpwn/cve-2026-116841-116842-devilutionx-libmpq-hash-block-table-oob
Exploit#
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.