A heap buffer overflow occurs in the libmpq__archive_dup routine bundled with DevilutionX. When the program opens an MPQ archive whose block table count exceeds the hash table count, the memcpy operation silently overflows the allocated heap buffer, corrupting memory. This vulnerability is classified as a CWE‑787 heap-based buffer overflow and is primarily a denial‑of‑service vector that causes the game to crash.

This issue affects DevilutionX version 1.4.0 through 1.5.5 as distributed by diasurgical. No other vendors or product versions are mentioned as impacted.

The CVSS score of 6.9 indicates moderate severity. EPSS information is not available, so the likelihood of exploitation remains unknown at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers must supply a crafted MPQ archive to the victim, implying a local or file‑based attack vector. If a user launches the game with a malicious archive, the heap corruption will occur during startup, resulting in a crash. No privileged escalation is required, and the effect is confined to the process memory of the player’s installation.