CVE-2026-116841 in DevilutionX
Summary
by MITRE • 10/27/2026
DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq__file_number_from_hash function that allows attackers to read heap memory via unchecked block_table_index values. Attackers can place a crafted .mpq archive in the game's data path, such as a mod, to trigger reads past mpq_map and crash the game.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in DevilutionX versions 1.4.0 through 1.5.5 represents a critical memory safety flaw located within the bundled libmpq library, specifically affecting the file number resolution logic. This component is responsible for mapping archive entries to their corresponding data blocks when processing MPQ (MoPaQ) files, which are commonly used as game archives in titles like Diablo and its fan-made ports such as DevilutionX. The core technical deficiency lies within the libmpq__file_number_from_hash function, where the implementation fails to perform adequate bounds checking on input parameters derived from external archive structures. When a crafted MPQ file is processed, the application extracts block_table_index values that are not validated against the actual size of the internal mpq_map data structure. This lack of validation allows an attacker to supply index values that exceed the allocated memory boundaries for this map array.
From a technical perspective, this flaw constitutes an out-of-bounds read vulnerability, which is formally categorized under CWE-125 in the Common Weakness Enumeration standard. The operational mechanism involves the application reading memory locations adjacent to or beyond the intended mpq_map buffer based on the maliciously crafted index provided by the attacker-controlled MPQ file. Because the input originates from a game mod or archive placed in the data path, it is treated as part of the legitimate game content during runtime initialization or level loading sequences. The unchecked nature of this read operation means that arbitrary heap memory contents are exposed to the application logic without any integrity verification. This exposure can lead to information disclosure if the leaked memory contains sensitive data such as encryption keys, session tokens, or other player-specific state information stored in adjacent heap allocations.
The primary operational impact observed with this vulnerability is a denial of service resulting from an application crash. When the out-of-bounds read retrieves invalid or protected memory addresses that cannot be accessed by the process, it triggers a segmentation fault or access violation exception within the game engine. This causes DevilutionX to terminate unexpectedly, disrupting gameplay and potentially causing loss of unsaved progress for users who load malicious mods. While immediate exploitation for arbitrary code execution is less likely due to the read-only nature of this specific flaw, out-of-bounds reads are often precursors to more severe vulnerabilities such as use-after-free scenarios or can be leveraged in conjunction with other memory corruption bugs to achieve remote code execution. The attack vector requires only that a user loads a malicious MPQ file, which aligns with the ATT&CK technique of T1059 Command and Scripting Interpreter if combined with further exploitation steps, though currently it primarily facilitates local denial-of-service attacks via social engineering or mod distribution channels.
Mitigation strategies for this vulnerability focus on both immediate patching and long-term defensive coding practices. The most effective remediation is to upgrade DevilutionX to a version newer than 1.5.5 where the libmpq library has been updated with proper bounds checking logic in the file number resolution functions. Developers should ensure that all array indices derived from external archives are validated against their respective maximum sizes before being used for memory access operations. Additionally, implementing strict input validation and sanitization routines within the MPQ parsing module can prevent malformed or maliciously crafted files from triggering these edge cases. For end-users, the recommended practice is to only load mods and archive modifications from trusted sources that have undergone security review, thereby reducing the risk of encountering crafted inputs designed to exploit memory safety flaws in game engines.