CVE-2026-116841 Details
Description
DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq__file_number_from_hash function that allows attackers to read heap memory via unchecked block_table_index values. Attackers can place a crafted .mpq archive in the game's data path, such as a mod, to trigger reads past mpq_map and crash the game.
A heap-based out-of-bounds read vulnerability has been identified in DevilutionX versions 1.4.0 through 1.5.5. This vulnerability resides in the 'libmpq__file_number_from_hash' function of the bundled libmpq library. The issue allows attackers to read arbitrary heap memory by exploiting unchecked 'block_table_index' values. By placing a crafted .mpq archive in the game's data path, such as a mod, attackers can trigger the vulnerability, causing the game to crash.
Users can update to DevilutionX version 1.5.6 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@haindpwn/devilutionx-libmpq-hash-block-table-oob | CISA-ADP | BundleExploitTechnical Analysis |
| https://github.com/diasurgical/DevilutionX/blob/7223eeac9e8274fbf665b4de86fda26d3b22c52f/3rdParty/libmpq/CMakeLists.txt | [email protected] | Source CodeVendor |
| https://github.com/diasurgical/DevilutionX/issues/8758 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/diasurgical/DevilutionX/pull/8482 | [email protected] | Issue TrackingVendor |
| https://github.com/diasurgical/libmpq/blob/b78d66c6fee6a501cc9b95d8556a129c68841b05/libmpq/mpq.c#L740 | [email protected] | Source CodeVendor |
| https://hackmd.io/@haindpwn/devilutionx-libmpq-hash-block-table-oob | [email protected] | BundleExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/devilutionx-1.4.0-through-1.5.5-out-of-bounds-read-via-libmpq-hash-table-lookup | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| DevilutionX | >= 1.4.0, <= 1.5.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |