CVE-2026-116841 DevilutionX 1.4.0 through 1.5.5 Out-of-Bounds Read via libmpq Hash Table Lookup

DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpqfilenumberfromhash function that allows attackers to read heap memory via unchecked blocktableindex values. Attackers can place a crafted .mpq archive in the game's data path, such as a mod, t...

CVE-2026-116841

DevilutionX versions 1.4.0 through 1.5.5 are vulnerable to an out-of-bounds read in the bundled libmpq library. The issue exists within the libmpq__file_number_from_hash function, where unchecked block_table_index values allow for reading heap memory. An attacker can trigger this vulnerability by...

EUVD-2026-110572

DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpqfilenumberfromhash function that allows attackers to read heap memory via unchecked blocktableindex values. Attackers can place a crafted .mpq archive in the game's data path, such as a mod, t...