{"id":"CVE-2026-116841","kind":"vulnerability","aliases":["CVE-2026-116841"],"related":[],"title":"DevilutionX: crafted MPQ archive causes out-of-bounds heap read and crash","description":"DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq__file_number_from_hash function that allows attackers to read heap memory via unchecked block_table_index values. Attackers can place a crafted .mpq archive in the game's data path, such as a mod, to trigger reads past mpq_map and crash the game.","summary":"DevilutionX 1.4.0 through 1.5.5 fails to bounds-check block table indexes in its bundled libmpq when resolving file hashes. A crafted .mpq archive placed in the game's data path, such as a mod, can make the game read past a heap buffer and crash.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","devilutionx","gaming","runtime"],"not_affected_if":["default-config","official-data-only"],"how_to_check":"- Check the installed DevilutionX version against the affected range `1.4.0` to `1.5.5`\n- Look for `.mpq` files in the game's data directory or mod folders that you did not put there","fix":"- Upgrade DevilutionX to a version later than `1.5.5` (the sources do not name the exact fixed release)\n- Remove untrusted `.mpq` mods from the data path until patched","status":"open","published_at":"2026-10-27T01:19:07+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","triaged_at":"2026-10-27T01:36:25+00:00","updated_at":"2026-10-27T01:36:25+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-27T01:36:25Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade DevilutionX to a version later than `1.5.5` (the sources do not name the exact fixed release)\n- Remove untrusted `.mpq` mods from the data path until patched","reach":"local","title":"DevilutionX: crafted MPQ archive causes out-of-bounds heap read and crash","impact":"low","summary":"DevilutionX 1.4.0 through 1.5.5 fails to bounds-check block table indexes in its bundled libmpq when resolving file hashes. A crafted .mpq archive placed in the game's data path, such as a mod, can make the game read past a heap buffer and crash.","category":"runtime","nicknames":[],"who_cares":["devilutionx","gaming","desktop"],"confidence":0.6,"needs_auth":"no","worst_case":"game crashes and heap memory is read from the process","analyst_note":"Confirm the fixed version and whether any code execution is possible; the NVD entry alone does not say.","how_to_check":"- Check the installed DevilutionX version against the affected range `1.4.0` to `1.5.5`\n- Look for `.mpq` files in the game's data directory or mod folders that you did not put there","needs_analyst":true,"not_affected_if":["default-config","official-data-only"],"who_is_affected":"Players and operators who run DevilutionX 1.4.0 through 1.5.5 and load third-party mods or archives from the game data path. Installs that use only the official game data and no untrusted mods are much less exposed. The sources describe a crash and a heap read, not code execution.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000619,"input_tokens":3358,"output_tokens":567,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116841':16A,19A '-2026':15A,18A '1.4.0':25B,71C '1.5.5':27B,73C 'allow':93C 'archiv':4A,47B,111C 'attack':94C,105C 'block':33B,101C 'bound':9A,31B,79C 'bounds-check':30B 'buffer':67B 'bundl':38B,84C 'caus':5A 'check':32B 'contain':74C 'craft':2A,45B,109C 'crash':13A,69B,129C 'cve':14A,17A 'data':53B,116C 'desktop':20B 'devilutionx':1A,21B,24B,70C 'fail':28B 'file':42B,87C 'function':91C 'game':22B,51B,62B,114C,131C 'hash':43B,90C 'heap':10A,66B,97C 'index':35B,103C 'libmpq':39B,85C,86C 'make':60B 'map':127C 'memori':98C 'mod':58B,121C 'mpq':3A,46B,110C,126C 'number':88C 'out-of-bound':6A,76C 'past':64B,125C 'path':54B,117C 'place':48B,107C 'read':11A,63B,80C,96C,124C 'resolv':41B 'runtim':23B 'tabl':34B,102C 'trigger':123C 'uncheck':100C 'valu':104C 'via':99C 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Players and operators who run DevilutionX 1.4.0 through 1.5.5 and load third-party mods or archives from the game data path. Installs that use only the official game data and no untrusted mods are much less exposed. The sources describe a crash and a heap read, not code execution.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T01:19:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116841","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116841","severity":null,"published_at":"2026-10-27T01:19:07+00:00","modified_at":"2026-10-27T01:19:07+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","fetched_at":"2026-10-27T01:34:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}