CVE-2026-116841
Medium · 5.5CVSS
5.5
EPSS
0.1%
Published
Oct 27, 2026
CISA due date
—
The record
DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq__file_number_from_hash function that allows attackers to read heap memory via unchecked block_table_index values. Attackers can place a crafted .mpq archive in the game's data path, such as a mod, to trigger reads past mpq_map and crash the game.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-62958 libriscv is a RISC-V sandbox and emulator. CWE-125
- CVE-2026-119338 Tesseract is an open source OCR engine. CWE-125
- CVE-2026-119299 gopacket provides packet processing capabilities for Go. CWE-125
- CVE-2026-119722 Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access… CWE-125
- CVE-2026-119721 Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds read vulnerability… CWE-125
- CVE-2026-119720 Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read… CWE-125
- CVE-2026-104063 Scribus before 1.6.7 contains an out-of-bounds read vulnerability in the Mac PICT image… CWE-125
- CVE-2026-61627 libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation… CWE-125