CVE-2026-116842
Last modified
CVE-2026-116842 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpq__archive_dup routine when opening crafted MPQ archives. Attackers can supply an MPQ archive whose block table count exceeds its hash table count, causing memcpy to overflow the heap during startup and crash the game.. EPSS estimates a 0.13% chance of exploitation in the next 30 days.
Description
DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpq__archive_dup routine when opening crafted MPQ archives. Attackers can supply an MPQ archive whose block table count exceeds its hash table count, causing memcpy to overflow the heap during startup and crash the game.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| diasurgical | DevilutionX | >= 1.4.0, <= 1.5.5 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-116842?
How severe is CVE-2026-116842?
How do I fix CVE-2026-116842?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-116837A malicious actor with access to the adjacent network could …8.8
- CVE-2026-116838A malicious actor who lures an authenticated user to a malic…8.8
- CVE-2026-116839A malicious actor who lures an authenticated user to a malic…7.1
- CVE-2026-11684Insufficient policy enforcement in Network in Google Chrome …3.1
- CVE-2026-116840llama.cpp b5854 before b11275 contains an integer overflow v…6.1
- CVE-2026-116841DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds re…5.5
- CVE-2026-116843Mistral Vibe before 3.0.3 contains a remote code execution v…8.8
- CVE-2026-116844Fclairamb ftpserverlib through 0.32.4 contains a cleartext t…4.8
- CVE-2026-116846Missing Authorization vulnerability in WP User Manager WP Us…5.3
- CVE-2026-116847Unauthenticated Cross Site Scripting (XSS) in Mang Board WP …7.1
- CVE-2026-116848Improper Neutralization of Input During Web Page Generation …6.5
- CVE-2026-116849Improper Neutralization of Input During Web Page Generation …6.5
Are you affected by CVE-2026-116842?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST