CVE-2026-116841 diasurgical CVE debrief

Who should care

DevilutionX users and administrators should assess exposure and verify patch deployment to prevent potential exploitation. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and planning vendor-supported updates or mitigations through normal change control where exposure is confirmed. Additionally, users should review compensating controls for exposed systems while remediation is

Why it matters

This out-of-bounds read vulnerability in DevilutionX 1.4.0 through 1.5.5 allows attackers to read heap memory, potentially leading to crashes or information disclosure. Users and administrators should assess exposure and verify patch deployment to prevent exploitation.

• Verify patch deployment for affected versions to prevent exploitation.
• Assess exposure of DevilutionX versions 1.4.0 through 1.5.5 in your environment.
• Monitor for potential exploitation attempts to detect possible attacks.

Technical summary

The DevilutionX 1.4.0 through 1.5.5 versions contain an out-of-bounds read vulnerability in the bundled libmpq libmpq__file_number_from_hash function. This allows attackers to read heap memory via unchecked block_table_index values by placing a crafted .mpq archive in the game's data path, potentially leading to crashes or information disclosure. The vulnerability can be triggered by placing a crafted .mpq archive in the game's data path, such as a mod, and can result in the game crashing or potentially disclosing sensitive information.

Defensive priority

Assess exposure and verify patch deployment for DevilutionX versions 1.4.0 through 1.5.5.

Recommended defensive actions

• Assess exposure of DevilutionX versions 1.4.0 through 1.5.5 in your environment.
• Verify patch deployment for affected versions.
• Monitor for potential exploitation attempts.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on an out-of-bounds read vulnerability in DevilutionX 1.4.0 through 1.5.5 via libmpq hash table lookup. Official sources include the CVE Program record, NVD vulnerability detail, and source item JSON.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.