CVE-2026-116842— DevilutionX 1.4.0 through 1.5.5 Heap Buffer Overflow via libmpq__archive_dup

Quick assessment

Affected

diasurgical DevilutionX

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

DevilutionX 1.4.0 至 1.5.5 版本中，其捆绑的 libmpq 库在 libmpq__archive_dup 函数中存在堆缓冲区溢出漏洞。当打开特制的 MPQ 存档时，攻击者可提供一个块表数量超过哈希表数量的 MPQ 文件，导致程序在启动期间执行 memcpy 操作时发生堆溢出，进而引发游戏崩溃。

CVSS 6.1 · Medium Updated Oct 27, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

DevilutionX 1.4.0 through 1.5.5 Heap Buffer Overflow via libmpq__archive_dup

Source: CVE Program / CVE List V5

Vulnerability Description

DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpq__archive_dup routine when opening crafted MPQ archives. Attackers can supply an MPQ archive whose block table count exceeds its hash table count, causing memcpy to overflow the heap during startup and crash the game.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存写

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
diasurgical	DevilutionX	1.4.0 ~ 1.5.5	-

II. Public POCs for CVE-2026-116842

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116842

请登录查看更多情报信息。

Other References for CVE-2026-116842 (6)

https://github.com/diasurgical/DevilutionX/pull/8482 patch issue-tracking
https://github.com/diasurgical/DevilutionX/issues/8758 issue-tracking
https://hackmd.io/@haindpwn/devilutionx-libmpq-hash-block-table-oob technical-description
https://github.com/diasurgical/DevilutionX/blob/7223eeac9e8274fbf665b4de86fda26d3b22c52f/3rdParty/libmpq/CMakeLists.txt technical-description
https://github.com/diasurgical/libmpq/blob/b78d66c6fee6a501cc9b95d8556a129c68841b05/libmpq/mpq.c#L505 technical-description
https://www.vulncheck.com/advisories/devilutionx-1.4.0-through-1.5.5-heap-buffer-overflow-via-libmpq-archive-dup third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-116842

IV. Related Vulnerabilities

Same product: DevilutionX

CVE-2026-116841
DevilutionX 1.4.0 through 1.5.5 Out-of-Bounds Read via libmp

Same vendor: diasurgical

CVE-2026-116841
DevilutionX 1.4.0 through 1.5.5 Out-of-Bounds Read via libmp

Same weakness: CWE-787