{"schema":"threatline.record/2","record":{"id":"CVE-2026-116841","aliases":[],"summary":"DevilutionX 1.4.0 through 1.5.5 Out-of-Bounds Read via libmpq Hash Table Lookup","details":"DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq__file_number_from_hash function that allows attackers to read heap memory via unchecked block_table_index values. Attackers can place a crafted .mpq archive in the game's data path, such as a mod, to trigger reads past mpq_map and crash the game.","categories":["Unclassified"],"product":"DevilutionX","vendor":"diasurgical","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116841","source_modified_at":"2026-10-27T00:34:00.513Z","fetched_at":"2026-10-27T04:51:10.072820Z","product":"DevilutionX","vendor":"diasurgical","versions":[{"version":"1.4.0","status":"affected","versionType":"semver","lessThanOrEqual":"1.5.5"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":6.8,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-27T00:34:00.513Z","modified_at":"2026-10-27T00:34:00.513Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-116841","fetched_at":"2026-10-27T04:51:10.072820Z","source_modified_at":"2026-10-27T00:34:00.513Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/diasurgical/DevilutionX/issues/8758","tags":["issue-tracking"]},{"source":"CVE List","url":"https://github.com/diasurgical/DevilutionX/pull/8482","tags":["patch","issue-tracking"]},{"source":"CVE List","url":"https://github.com/diasurgical/libmpq/blob/b78d66c6fee6a501cc9b95d8556a129c68841b05/libmpq/mpq.c#L740","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/diasurgical/DevilutionX/blob/7223eeac9e8274fbf665b4de86fda26d3b22c52f/3rdParty/libmpq/CMakeLists.txt","tags":["technical-description"]},{"source":"CVE List","url":"https://hackmd.io/@haindpwn/devilutionx-libmpq-hash-block-table-oob","tags":["technical-description"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/devilutionx-1.4.0-through-1.5.5-out-of-bounds-read-via-libmpq-hash-table-lookup","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-27T00:34:00.513Z","content_hash":"eeedace388e67f9733840c93229404abe41509bc1feb606f4aa4bb168c392928"}}