CVE-2026-116842

MediumCVSS 6.1/10Last modified Oct 31, 2026

Description

DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpq__archive_dup routine when opening crafted MPQ archives. Attackers can supply an MPQ archive whose block table count exceeds its hash table count, causing memcpy to overflow the heap during startup and crash the game.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
diasurgical	DevilutionX	>= 1.4.0, <= 1.5.5

References

Timeline

Published: Oct 27, 2026
Last modified: Oct 31, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1168438.8Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter driver CVE-2026-1168444.8Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag CVE-2026-1168455.4NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows authenticated users to CVE-2026-1168465.3Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Contr CVE-2026-1168477.1Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions.CVE-2026-1168486.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Innovations The Plus Addons f CVE-2026-1168496.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins StreamCast streamcast allows CVE-2026-116854.3Inappropriate implementation in MediaCapture in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to leak cross-origin CVE-2026-1168506.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happ CVE-2026-1168517.1Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions.CVE-2026-1168529.1Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions.CVE-2026-1168536.5Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions.