Out-of-Bounds Read Vulnerability in DevilutionX by Diasurgical
CVE-2026-116841

6.8MEDIUM

Key Information:

Vendor

Diasurgical

Status
Devilutionx
Vendor
CVE Published:
27 October 2026

What is CVE-2026-116841?

DevilutionX versions 1.4.0 through 1.5.5 include an out-of-bounds read vulnerability linked to the libmpq file handling functionality. This flaw occurs when the block_table_index values are not properly checked, allowing attackers to exploit crafted .mpq archives. By placing malicious content within the game's data path, an attacker can initiate unauthorized reads of heap memory, potentially leading to game crashes and revealing sensitive information. Users of affected versions should update as patches have been released to remediate this vulnerability.

Affected Version(s)

DevilutionX 1.4.0 <= 1.5.5

References

https://github.com/diasurgical/DevilutionX/issues/8758
issue-tracking
https://github.com/diasurgical/DevilutionX/pull/8482
patchissue-tracking
https://github.com/diasurgical/libmpq/blob/b78d66c6fee6a5...
technical-description

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.