Medium severity · published Oct 27, 2026
CVE-2026-116842
DevilutionX 1.4.0 through 1.5.5 Heap Buffer Overflow via libmpq__archive_dup
New
6.1
CVSS
0.1%
EPSS
No
On KEV
Description
DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpq__archive_dup routine when opening crafted MPQ archives. Attackers can supply an MPQ archive whose block table count exceeds its hash table count, causing memcpy to overflow the heap during startup and crash the game.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DE
DevilutionX · diasurgical
1.4.0 through 1.5.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116842
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116842
github.com
https://github.com/diasurgical/DevilutionX/blob/7223eeac9e8274fbf665b4de86fda26d3b22c52f/3rdParty/libmpq/CMakeLists.txt
github.com
https://github.com/diasurgical/DevilutionX/issues/8758
github.com
https://github.com/diasurgical/DevilutionX/pull/8482
github.com
https://github.com/diasurgical/libmpq/blob/b78d66c6fee6a501cc9b95d8556a129c68841b05/libmpq/mpq.c#L505
hackmd.io
https://hackmd.io/@haindpwn/devilutionx-libmpq-hash-block-table-oob
www.vulncheck.com
https://www.vulncheck.com/advisories/devilutionx-1.4.0-through-1.5.5-heap-buffer-overflow-via-libmpq-archive-dup
More from DevilutionX
5.5
CVE-2026-116841
DevilutionX 1.4.0 through 1.5.5 Out-of-Bounds Read via libmpq Hash Table Lookup