CVE-2026-116842 in DevilutionX
Summary
by MITRE • 10/27/2026
DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpq__archive_dup routine when opening crafted MPQ archives. Attackers can supply an MPQ archive whose block table count exceeds its hash table count, causing memcpy to overflow the heap during startup and crash the game.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The DevilutionX project, a modern open-source reimplementation of the classic action role-playing game Diablo, contains a critical memory safety vulnerability in versions 1.4.0 through 1.5.5. This flaw resides within the bundled libmpq library, specifically in the archive duplication routine known as libmpq__archive_dup. The vulnerability is triggered when the application attempts to open and process MPQ (MoPaQ) archives, which are proprietary file formats used extensively by Blizzard Entertainment games for storing game assets such as graphics, sound files, and data tables. During the initialization phase of loading these archives, the software performs a series of memory allocation and copy operations that fail to adequately validate input parameters against allocated buffer boundaries.
The technical root cause of this vulnerability is an improper boundary check within the archive duplication logic. Specifically, the code assumes that certain structural counts within the MPQ file format are consistent or bounded in a way that matches pre-allocated heap buffers. When an attacker supplies a crafted MPQ archive where the block table count exceeds the hash table count, the application miscalculates the required memory size for internal data structures. This discrepancy leads to a memcpy operation attempting to write more data than has been allocated on the heap. Because this overflow occurs in user-space memory rather than kernel space, it does not directly compromise system-level privileges but poses severe risks to the stability and integrity of the application itself.
From an operational perspective, the immediate impact of exploiting this vulnerability is a denial of service condition manifested as a crash or segmentation fault during game startup. When the heap buffer overflow occurs, the memory corruption typically results in undefined behavior that quickly leads to program termination. For players attempting to load custom maps, mods, or modified assets packaged within MPQ archives, this means the application becomes unusable until it is restarted or patched. While a simple crash may seem less severe than arbitrary code execution, heap overflows are notoriously difficult to control precisely and can sometimes be leveraged for more sophisticated attacks if additional memory corruption primitives exist in subsequent operations. The vulnerability effectively allows any user-provided MPQ file with malformed structural metadata to disrupt the service availability of the game client.
This flaw aligns closely with Common Weakness Enumeration (CWE) identifiers such as CWE-120, which describes Buffer Copy without Checking Size of Input Classic Heap-based Overflow, and potentially CWE-787, Out-of-bounds Write on a heap buffer. In terms of threat modeling and adversary tactics, this vulnerability can be categorized under the MITRE ATT&CK framework technique T1496, Resource Hijacking, as it consumes system resources to cause disruption, although its primary classification remains within application-level denial of service vectors rather than persistent compromise mechanisms. The exploitation requires only that a victim opens a maliciously crafted file, placing this in the context of local or network-based input validation failures depending on how the MPQ files are sourced by the user.
Mitigation strategies for this vulnerability primarily involve updating DevilutionX to version 1.5.6 or later, where developers have implemented stricter bounds checking and validation logic within the libmpq library. For organizations deploying custom builds of the software, it is essential to ensure that all dependencies including libmpq are updated to patched versions. Additionally, users should exercise caution when loading MPQ archives from untrusted sources, as these files may contain malformed headers designed specifically to trigger such memory safety violations. Implementing input sanitization at the application level and utilizing static analysis tools during development can help identify similar logic errors in other parts of the codebase that handle binary file parsing.