DevilutionX CVE-2026-116841

Exploitation requires the attacker to place a specially crafted .mpq archive (for example, bundled inside a DevilutionX mod) into the game's data path, and requires the victim to then load that archive by running the game - this is the UI:P/user-interaction and AV:L/local-access condition. The malicious block_table_index value is only reached through libmpq's hash/block table lookup (libmpq__file_number_from_hash), so a legitimate, unmodified installation using only official game data is not affected. Limiting factors: no remote or network path, no privilege escalation, and dependence on the user installing and loading an untrusted third-party archive; impact is limited to crashing the game process (availability), with no confidentiality or integrity effect per the vendor CVSS.

This is a genuinely medium-severity, low-urgency issue, and the signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) describes a local vulnerability whose only impact is to availability - the out-of-bounds read in libmpq__file_number_from_hash crashes the game; confidentiality impact is explicitly rated N, so despite the CWE-125 'out-of-bounds read' classification and the description's mention of reading heap memory, the vendor-scored realistic outcome is a denial-of-service (crash), not attacker-controlled data exfiltration. Exploitation is not remote: the attacker must get a crafted .mpq archive onto the victim's local data path (e.g., distributing a malicious mod) and the victim must load it (UI:P). EPSS is very low (0.12%, 2nd percentile), there is no CISA KEV listing, and the vuln.today decision label is 'this_month' (not act_now/emergency) - all of which agree this is a patch-on-normal-cadence issue rather than a fire drill. The one caveat defenders should note: PR:N is scored because no authentication is needed, but exploitation is entirely gated on social-engineering a user into installing an untrusted mod/archive, so real-world risk is bounded by user behavior, not by network exposure.

An attacker publishes a malicious DevilutionX mod containing a crafted .mpq archive with an out-of-range block_table_index. A victim downloads and installs the mod into the game's data path and launches the game; when libmpq performs its hash/block table lookup it reads past the mpq_map allocation and the game crashes (denial of service). A public technical write-up describing the flaw exists, but exploitation requires local file placement and user interaction, so there is no remote network vector.