Threats tagged 'ghsa-mqmm-g9r5-977r'

DevilutionX versions 1.4.0 through 1.5.5 contain an out-of-bounds read vulnerability in the bundled libmpq library. This flaw occurs in the libmpq__file_number_from_hash function, allowing attackers to read heap memory by supplying unchecked block_table_index values. Exploitation requires placing a crafted .mpq archive, such as a mod, in the game's data path, which can cause the game to read beyond intended memory bounds and crash.