Heap buffer overflow in DevilutionX when opening crafted MPQ archives
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow (CWE-787) in the bundled libmpq routine libmpq__archive_dup, triggered when it opens a crafted MPQ archive. An attacker can supply an archive whose block table count exceeds its hash table count, so memcpy writes past the heap buffer during startup and crashes the game. The CVSS 4.0 base score is 6.9 (MEDIUM), with a local attack vector and user interaction required. CISA's SSVC rates exploitation as poc, and the issue is not listed in KEV.
Written with Claude Haiku 5.5 from the sources below · 2026-10-31
Description from the CNA
DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpq__archive_dup routine when opening crafted MPQ archives. Attackers can supply an MPQ archive whose block table count exceeds its hash table count, causing memcpy to overflow the heap during startup and crash the game.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| diasurgical | DevilutionX | 1.4.0 – 1.5.5 | — | No fix listed | CNA |
- DevilutionX Vendordiasurgical Affected 1.4.0 – 1.5.5 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for DevilutionX.
Written with Claude Haiku 5.5 from the sources below · 2026-10-31
Timeline
- 2026-10-27 Threatist record created from CVE-2026-116842
- 2026-10-27 Alias added: GHSA-g75x-vcw6-3m3f
- 2026-10-27 Priority changed: MEDIUM → LOW
- 2026-10-31 CISA SSVC decision points changed
- 2026-10-31 Priority changed: LOW → MEDIUM
References
Other 4
- https://github.com/diasurgical/DevilutionX/issues/8758
- https://github.com/diasurgical/libmpq/blob/b78d66c6fee6a501cc9b95d8556a129c68841b05/libmpq/mpq.c#L505
- https://github.com/diasurgical/DevilutionX/blob/7223eeac9e8274fbf665b4de86fda26d3b22c52f/3rdParty/libmpq/CMakeLists.txt
- https://hackmd.io/@haindpwn/devilutionx-libmpq-hash-block-table-oob
More diasurgical vulnerabilities
- TI-2026-81007 Out-of-bounds read in DevilutionX libmpq hash table lookup CVSS 4.0MEDIUM 6.8
Sources
- CVE-2026-116842 · CVE Program
- CVE-2026-116842 · NVD
- FIRST EPSS
- GHSA-g75x-vcw6-3m3f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences