CVE-2026-116841

DevilutionX versions 1.4.0 through 1.5.5 are vulnerable to an out-of-bounds read in the bundled libmpq library. The issue exists within the libmpq__file_number_from_hash function, where unchecked block_table_index values allow for reading heap memory. An attacker can trigger this vulnerability by...