CVE-2026-116842 diasurgical CVE debrief

Who should care

Defenders responsible for systems or deployments using DevilutionX versions 1.4.0 through 1.5.5 should assess exposure and prioritize remediation or compensating controls to prevent potential crashes or anomalies.

Why it matters

Defenders should prioritize verifying DevilutionX versions and assessing exposure to crafted MPQ archives to prevent potential crashes. Remediation involves updating to a version outside the affected range, if available, and implementing compensating controls.

• Verification of DevilutionX versions and exposure to crafted MPQ archives is necessary to prevent potential crashes.
• Implementing compensating controls to monitor and restrict untrusted MPQ archives can help mitigate the vulnerability.
• Remediation priority is moderate, given the potential for a crash and the availability of possible patches or updates.

Technical summary

The vulnerability exists in the libmpq __archive_dup routine of DevilutionX versions 1.4.0 through 1.5.5. A crafted MPQ archive can trigger a heap buffer overflow by exceeding the hash table count with its block table count, leading to a crash during game startup. This vulnerability can be exploited by supplying an MPQ archive with a block table count that exceeds its hash table count, causing memcpy to overflow the heap during startup and crash the game. Defenders should prioritize verifying the versions of DevilutionX in use and assessing exposure to crafted MPQ archives.

Defensive priority

Defenders should prioritize verifying the versions of DevilutionX in use and assessing exposure to crafted MPQ archives. Remediation involves updating to a version outside the affected range, if available, and implementing compensating controls to monitor and restrict the opening of untrusted MPQ archives.

Recommended defensive actions

• Verify DevilutionX versions in use and assess exposure to crafted MPQ archives
• Restrict the opening of untrusted MPQ archives
• Monitor for and respond to potential crashes or anomalies in the game
• Consider updating to a version outside the affected range, if available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to technical descriptions and potential patches. However, information on exploitation, impact, and remediation is limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.