CVE-2026-116841— DevilutionX 1.4.0 through 1.5.5 Out-of-Bounds Read via libmpq Hash Table Lookup
Quick assessment
Affected
diasurgical DevilutionX
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
DevilutionX 1.4.0 至 1.5.5 版本中，随包附带的 libmpq 库在 函数中存在越界读取漏洞。攻击者可通过未经验证的 值读取堆内存。攻击者可将精心构造的 归档文件放置于游戏的数据路径（例如模组目录）中，从而触发对 之后的内存读取，导致游戏崩溃。
Possible ATT&CK Techniques 2 AI
T1055.001 · Dynamic-link Library Injection T1203 · Exploitation for Client Execution
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-116841
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
DevilutionX 1.4.0 through 1.5.5 Out-of-Bounds Read via libmpq Hash Table Lookup
Source: CVE Program / CVE List V5
Vulnerability Description
DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq__file_number_from_hash function that allows attackers to read heap memory via unchecked block_table_index values. Attackers can place a crafted .mpq archive in the game's data path, such as a mod, to trigger reads past mpq_map and crash the game.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| diasurgical | DevilutionX | 1.4.0 ~ 1.5.5 | - |
|
II. Public POCs for CVE-2026-116841
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-116841
请登录查看更多情报信息。
Other References for CVE-2026-116841 (6)
-
-
https://github.com/diasurgical/DevilutionX/issues/8758 issue-tracking
-
https://hackmd.io/@haindpwn/devilutionx-libmpq-hash-block-table-oob technical-description
IV. Related Vulnerabilities
Same weakness: CWE-125
-
CVE-2025-71439
llama.cpp before b5649 Heap Out-of-Bounds Read via llama_voc -
CVE-2024-58399
llama.cpp before b2731 Out-of-Bounds Read via GGUF Tensor Of -
CVE-2026-116620
Tencent RapidJSON Regex stream.h Take out-of-bounds -
CVE-2026-116744
ntop nDPI through 6.0 Out-of-Bounds Read in SoftEther Dissec -
CVE-2026-116736
libpff through 20260926 Heap Out-of-Bounds Read via libpff_t