---
id: "CVE-2026-116842"
kind: "vulnerability"
aliases: ["CVE-2026-116842"]
title: "DevilutionX: crafted MPQ archive overflows heap, crashes the game"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["devilutionx", "gaming", "package", "self-hosted"]
not_affected_if: ["default-config", "trusted-mpq-only"]
published_at: "2026-10-27T01:19:07+00:00"
first_seen_at: "2026-10-27T01:34:33+00:00"
updated_at: "2026-10-27T01:36:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116842", "first_seen_at": "2026-10-27T01:34:33+00:00"}]
---

# DevilutionX: crafted MPQ archive overflows heap, crashes the game

DevilutionX 1.4.0 through 1.5.5 has a heap buffer overflow in its bundled libmpq library when it opens an MPQ archive. A crafted archive whose block table count exceeds its hash table count makes memcpy write past the heap buffer during startup, crashing the game.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `DevilutionX --version` or check the installed version in the app's about screen; affected builds are `1.4.0` through `1.5.5`.
- Check whether the build bundles libmpq and whether the source is at a commit that includes the fix (unknown from the sources).

## Fix

- Move DevilutionX to a release newer than `1.5.5` (the fixed version is unknown from the sources).
- Do not open MPQ archives from untrusted sources until upgraded.

## Timeline

- 2026-10-27T01:34:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116842

## From the sources

DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpq__archive_dup routine when opening crafted MPQ archives. Attackers can supply an MPQ archive whose block table count exceeds its hash table count, causing memcpy to overflow the heap during startup and crash the game.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_