Threats affecting pkg:github/DevilutionX

DevilutionX versions 1.4.0 through 1.5.5 contain a heap buffer overflow vulnerability in the bundled libmpq library. The flaw occurs in the libmpq__archive_dup routine when opening specially crafted MPQ archives with a block table count exceeding the hash table count. This causes a heap overflow via memcpy during game startup, leading to a crash.

DevilutionX versions 1.4.0 through 1.5.5 contain an out-of-bounds read vulnerability in the bundled libmpq library. This flaw occurs in the libmpq__file_number_from_hash function due to unchecked block_table_index values, allowing attackers to read heap memory. Exploitation requires placing a crafted .mpq archive, such as a mod, in the game's data path, which can trigger reads beyond the intended memory bounds and cause the game to crash.