These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A heap buffer overflow vulnerability exists in DevilutionX versions 1.4.0 through 1.5.5, specifically in the libmpq __archive_dup routine. This vulnerability can be triggered by opening a crafted MPQ archive with a block table count that exceeds its hash table count, leading to a memcpy operation that overflows the heap during game startup, causing a crash.
The DevilutionX 1.4.0 through 1.5.5 versions have an out-of-bounds read vulnerability in the bundled libmpq libmpq__file_number_from_hash function. This allows attackers to read heap memory via unchecked block_table_index values by placing a crafted .mpq archive in the game's data path, potentially leading to crashes or information disclosure. DevilutionX users and administrators should assess exposure an [truncated]