Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-116841

DevilutionX 1.4.0 through 1.5.5 Out-of-Bounds Read via libmpq Hash Table Lookup

DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq__file_number_from_hash function that allows attackers to read heap memory via unchecked block_table_index values. Attackers can place a crafted .mpq archive in the game's data path, such as a mod, to trigger reads past mpq_map and crash the game.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Diasurgical
Products
Devilutionx
CVE-2026-116842

DevilutionX 1.4.0 through 1.5.5 Heap Buffer Overflow via libmpq__archive_dup

DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpq__archive_dup routine when opening crafted MPQ archives. Attackers can supply an MPQ archive whose block table count exceeds its hash table count, causing memcpy to overflow the heap during startup and crash the game.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Diasurgical
Products
Devilutionx