Heap Buffer Overflow in DevilutionX by Diasurgical
CVE-2026-116842
6.9MEDIUM
What is CVE-2026-116842?
A heap buffer overflow vulnerability exists in the DevilutionX game, specifically in the libmpq library's libmpq__archive_dup function. This issue can be exploited when an attacker provides a malicious MPQ archive with a block table count that exceeds the hash table count. This discrepancy leads to a memcpy operation that overflows allocated memory on the heap, potentially causing crashes and providing an attack vector for system compromise. Users of DevilutionX from versions 1.4.0 through 1.5.5 are strongly advised to update to the latest version to mitigate this vulnerability.
Affected Version(s)
DevilutionX 1.4.0 <= 1.5.5
References
CVSS V4
Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
HaiND from the Post and Telecommunication Institute of Technology