CVE and update status of the FreeBSD ports tree3,610 unaddressed CVEs in 709 portsAll times are CET
CVE details

CVE-2026-116842

DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpq__archive_dup routine when opening crafted MPQ archives. Attackers can supply an MPQ archive whose block table count exceeds its hash table count, causing memcpy to overflow the heap during startup and crash the game.

Score
6.9 medium
Published
2026-10-27
Links
NVD · cve.org · Report wrong data

Matched ports (1)

PortPackageVersionStatusMaintainer
games/devilutionXdevilutionX1.5.5_1unaddressedamdmi3@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>devilutionX</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow
	vulnerability in the bundled libmpq libmpq__archive_dup routine when
	opening crafted MPQ archives. Attackers can supply an MPQ archive
	whose block table count exceeds its hash table count, causing memcpy
	to overflow the heap during startup and crash the game.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-116842</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-116842</url>
    </references>
    <dates>
      <discovery>2026-10-27</discovery>
      <entry>2026-10-27</entry>
    </dates>
  </vuln>