DevilutionX EUVD-2026-110573

Exploitation requires the victim to launch DevilutionX (versions 1.4.0 through 1.5.5) while a crafted MPQ archive is present in the data the engine loads at startup - specifically an archive whose block table count is larger than its hash table count, which drives the overflowing memcpy inside the bundled libmpq's libmpq__archive_dup routine. Limiting factors that reduce real-world risk: the attack vector is local (AV:L), so the attacker must first get the malicious MPQ file onto the victim's system; the victim must then run the game, i.e. passive user interaction is required (UI:P); only the vulnerable version range 1.4.0-1.5.5 is affected; and the observed outcome is a startup crash (availability/DoS), with no confidentiality impact and no demonstrated arbitrary code execution.

This is a genuine but low-urgency issue that the signals consistently agree on - there is no high-CVSS/low-real-risk tension here, and in fact the CVSS 4.0 score is already only medium (6.9). The vector is CVSS:4.0/AV:L (local) with AT:N/AC:L/PR:N/UI:P, and the sole meaningful impact is availability (VA:H) - the heap buffer overflow in libmpq__archive_dup crashes the game at startup; VC:N and VI:L mean no confidentiality loss and at most minor integrity impact, with no demonstrated code execution. EPSS is very low (0.13%, 3rd percentile) and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation; exploitation status is best described as: a public technical writeup/PoC reference exists (hackmd analysis plus VulnCheck advisory) but it is not verified as working weaponized exploit code. The vuln.today decision label is 'this_month' (not act_now/emergency), matching the picture of a locally-triggered denial-of-service in a niche game rather than a widespread remote threat. Net: real and worth patching this month, but low real-world risk - local vector, user must launch the game against a crafted archive, and impact is a crash rather than compromise.

An attacker crafts a malformed MPQ archive whose block table count exceeds its hash table count and gets it onto a victim's system in place of (or alongside) the game data DevilutionX loads. When the victim launches DevilutionX 1.4.0-1.5.5, the bundled libmpq's libmpq__archive_dup routine performs a memcpy that overruns the heap, crashing the game on startup (local vector, passive user interaction). A public technical writeup and vendor advisory describe the flaw, but no verified working exploit code beyond a crash PoC is confirmed, and only a denial-of-service (not code execution) has been demonstrated.