Live › vulnerability › CVE-2026-116841
Go to dashboardDevilutionX 1.4.0 through 1.5.5 fails to bounds-check block table indexes in its bundled libmpq when resolving file hashes. A crafted .mpq archive placed in the game's data path, such as a mod, can make the game read past a heap buffer and crash.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 01:34 UTC. All times on this page are UTC.
Players and operators who run DevilutionX 1.4.0 through 1.5.5 and load third-party mods or archives from the game data path. Installs that use only the official game data and no untrusted mods are much less exposed. The sources describe a crash and a heap read, not code execution.
No product ranges from the sources yet.
1.4.0 to 1.5.5.mpq files in the game's data directory or mod folders that you did not put there1.5.5 (the sources do not name the exact fixed release).mpq mods from the data path until patchedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq__file_number_from_hash function that allows attackers to read heap memory via unchecked block_table_index values. Attackers can place a crafted .mpq archive in the game's data path, such as a mod, to trigger reads past mpq_map and crash the game.
This page as .md · .json · in your agent: get_signal("CVE-2026-116841")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.