DevilutionX vulnerabilities
CVEs whose affected-version data names the DevilutionX package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-116842Medium· 6.1DevilutionX 1.4.0 through 1.5.5 Heap Buffer Overflow via libmpq__archive_dup
DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpq__archive_dup routine when opening crafted MPQ archives. Attackers can supply an MPQ archive whose block table count exceeds its ha…
▾ Sunlitdiasurgical · DevilutionXEPSS 0.13%via CVEORG
CVE-2026-116841Medium· 5.5DevilutionX 1.4.0 through 1.5.5 Out-of-Bounds Read via libmpq Hash Table Lookup
DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq__file_number_from_hash function that allows attackers to read heap memory via unchecked block_table_index values. Attackers can pla…
▾ Sunlitdiasurgical · DevilutionXEPSS 0.12%via CVEORG