{"id":"CVE-2026-116842","kind":"vulnerability","aliases":["CVE-2026-116842"],"related":[],"title":"DevilutionX: crafted MPQ archive overflows heap, crashes the game","description":"DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpq__archive_dup routine when opening crafted MPQ archives. Attackers can supply an MPQ archive whose block table count exceeds its hash table count, causing memcpy to overflow the heap during startup and crash the game.","summary":"DevilutionX 1.4.0 through 1.5.5 has a heap buffer overflow in its bundled libmpq library when it opens an MPQ archive. A crafted archive whose block table count exceeds its hash table count makes memcpy write past the heap buffer during startup, crashing the game.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["devilutionx","gaming","package","self-hosted"],"not_affected_if":["default-config","trusted-mpq-only"],"how_to_check":"- Run `DevilutionX --version` or check the installed version in the app's about screen; affected builds are `1.4.0` through `1.5.5`.\n- Check whether the build bundles libmpq and whether the source is at a commit that includes the fix (unknown from the sources).","fix":"- Move DevilutionX to a release newer than `1.5.5` (the fixed version is unknown from the sources).\n- Do not open MPQ archives from untrusted sources until upgraded.","status":"open","published_at":"2026-10-27T01:19:07+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","triaged_at":"2026-10-27T01:36:21+00:00","updated_at":"2026-10-27T01:36:21+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T01:36:21Z","model":"claude-haiku-5-5","output":{"fix":"- Move DevilutionX to a release newer than `1.5.5` (the fixed version is unknown from the sources).\n- Do not open MPQ archives from untrusted sources until upgraded.","reach":"local","title":"DevilutionX: crafted MPQ archive overflows heap, crashes the game","impact":"low","summary":"DevilutionX 1.4.0 through 1.5.5 has a heap buffer overflow in its bundled libmpq library when it opens an MPQ archive. A crafted archive whose block table count exceeds its hash table count makes memcpy write past the heap buffer during startup, crashing the game.","category":"package","nicknames":[],"who_cares":["devilutionx","gaming","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Game crashes at startup when a crafted archive is opened.","analyst_note":"Check the NVD entry and the DevilutionX repository for the fixed release and whether the overflow can do more than crash.","how_to_check":"- Run `DevilutionX --version` or check the installed version in the app's about screen; affected builds are `1.4.0` through `1.5.5`.\n- Check whether the build bundles libmpq and whether the source is at a commit that includes the fix (unknown from the sources).","needs_analyst":true,"not_affected_if":["default-config","trusted-mpq-only"],"who_is_affected":"Players and machines that open MPQ archives supplied by someone else, such as a downloaded or shared game data file, are the exposed case. The sources describe a crash at startup and do not describe code execution. Installs that only use the original game data they already trust have less exposure.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000635,"input_tokens":3349,"output_tokens":601,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116842':12A,15A '-2026':11A,14A '1.4.0':23B,67C '1.5.5':25B,69C 'archiv':4A,41B,44B,81C,88C,94C 'attack':89C 'block':46B,96C 'buffer':29B,60B,73C 'bundl':33B,78C 'caus':104C 'contain':70C 'count':48B,53B,98C,103C 'craft':2A,43B,86C 'crash':7A,63B,113C 'cve':10A,13A 'devilutionx':1A,16B,22B,66C 'dup':82C 'exceed':49B,99C 'game':9A,17B,65B,115C 'hash':51B,101C 'heap':6A,28B,59B,72C,109C 'host':21B 'libmpq':34B,79C,80C 'librari':35B 'make':54B 'memcpi':55B,105C 'mpq':3A,40B,87C,93C 'open':38B,85C 'overflow':5A,30B,74C,107C 'packag':18B 'past':57B 'routin':83C 'self':20B 'self-host':19B 'startup':62B,111C 'suppli':91C 'tabl':47B,52B,97C,102C 'vulner':75C 'whose':45B,95C 'write':56B","nicknames":[],"mitigations":[],"who_affected":"Players and machines that open MPQ archives supplied by someone else, such as a downloaded or shared game data file, are the exposed case. The sources describe a crash at startup and do not describe code execution. Installs that only use the original game data they already trust have less exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T01:19:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116842","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116842","severity":null,"published_at":"2026-10-27T01:19:07+00:00","modified_at":"2026-10-27T01:19:07+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","fetched_at":"2026-10-27T01:34:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}