Live › vulnerability › CVE-2026-116842
Go to dashboardDevilutionX 1.4.0 through 1.5.5 has a heap buffer overflow in its bundled libmpq library when it opens an MPQ archive. A crafted archive whose block table count exceeds its hash table count makes memcpy write past the heap buffer during startup, crashing the game.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 01:34 UTC. All times on this page are UTC.
Players and machines that open MPQ archives supplied by someone else, such as a downloaded or shared game data file, are the exposed case. The sources describe a crash at startup and do not describe code execution. Installs that only use the original game data they already trust have less exposure.
No product ranges from the sources yet.
DevilutionX --version or check the installed version in the app's about screen; affected builds are 1.4.0 through 1.5.5.1.5.5 (the fixed version is unknown from the sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpq__archive_dup routine when opening crafted MPQ archives. Attackers can supply an MPQ archive whose block table count exceeds its hash table count, causing memcpy to overflow the heap during startup and crash the game.
This page as .md · .json · in your agent: get_signal("CVE-2026-116842")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.