Heap Overflow Chain in Titan Quest: Anniversary Edition via Malicious Custom Map/Particle Files — Threadlinqs Intelligence
As of 2026-08-02, Heap Overflow Chain in Titan Quest: Anniversary Edition via Malicious Custom Map/Particle Files is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 29 indicators of compromise.
Threat ID: TL-2026-1817 · Severity: HIGH · Status: ACTIVE · Category: VULNERABILITY
Synacktiv researcher Thomas Dubier disclosed multiple heap overflow vulnerabilities in Titan Quest: Anniversary Edition v2.10.21415 (Engine.dll), reachable via malicious .lvl level-descriptor files
Synacktiv's 29 July 2026 publication "Exploiting Titan Quest" documents a full exploit chain against the game engine (Engine.dll, a 32-bit module) shipped with Titan Quest: Anniversary Edition v2.10.21415, tested against a Windows 11 Professional VM (build 10.0.26200).
The research began with an attack-surface enumeration: the researcher identified 49 distinct methods in Engine.dll that accept a BinaryReader structure as input, i.e. the full set of file-parsing entry points reachable from untrusted .map/.lvl/.wrl/.pfx content, then reverse-engineered these formats' deserialization routines to find exploitable bugs among them.
Two distinct memory-safety bugs were identified. First, GAME::ImpassableData::Load, invoked when parsing a .lvl level-descriptor file's CHUNK_TYPE_IMPASSABLE_DATA (0x03) block, allocates a byte buffer sized by multiplying attacker-controlled width and height fields; this multiplication can integer-overflow past 32 bits, producing an undersized allocation, after which an unvalidated count-sized memcpy (memcpy(buffer, binaryRead->currentPtr, count)) overflows the heap buffer. Second, GAME::EmitterData::InternalBinaryRead, invoked when parsing a .pfx particle-effect file, copies six variable-length arrays (strings, boolean arrays, DWORD arrays, curve data) read directly from the file into a fixed-size GAME::EmitterData structure with no bounds checks, producing further heap overflows; the researcher assessed these as less exploitable because the allocation size itself is uncontrolled.
The demonstrated exploit chain weaponizes the ImpassableData bug. First, GAME::Water::Load is abused for heap feng shui: many WaterType objects (up to 128 layers, texture-name strings up to 1MB each) are allocated to fill the heap, chunks sized like a Level object (~0x4000+ bytes, forcing Windows 11's Segment Heap) are allocated, and reference-counted object lifetimes are manipulated so that freeing chunk 2 then chunk 4 in a FIFO pattern creates predictable "holes" that the next same-sized allocations land into — first the Level object, then the Impassable Buffer — in adjacent, deterministic positions. Second, ASLR is defeated by address-space exhaustion: roughly 128MB of WaterType allocations (128 layers x up to 1MB texture-name strings) are sprayed so allocation addresses become predictable in their lower 12 bits (landing on XXXXX000-aligned pages), and a repeated payload structure is embedded inside each WaterType's noiseTextureName field for later use. Third, a crafted .lvl file with an oversized CHUNK_TYPE_IMPASSABLE_DATA block triggers the heap overflow to corrupt the adjacent Level object's _water pointer, redirecting it into the fabricated Water object planted via the noiseTextureName spray. Fourth, a CHUNK_TYPE_WATER (0x09) block causes GAME::Level::NewWater to run against the corrupted pointer; its destructor invokes an indirect vtable call — (*layer)->vtable->release(*layer, 1) — on the corrupted WaterLayer object, redirecting control flow to a ROP gadget at 0x10021b91 (xchg esp, eax; pop edi; pop esi; pop ebp; pop ebx; ret) that pivots the stack into heap-resident attacker data. From there a ROP-driven call into a native memory-protection API performs the standard heap-executable transformation, and shellcode execution on the corrupted heap completes the chain.
The distribution/attack vector is entirely file-based and social: Titan Quest supports community-authored custom maps that players manually copy into %USERPROFILE%\Documents\My Games\Titan Quest - Immortal Throne\custommaps. A malicious .map (which bundles .lvl/.tga content), .lvl, or .pfx file shared through the game's active modding community is sufficient to reach the vulnerable parsers — no network exposure or authentication bypass is required, but the victim must be persuaded to install third-party content. This mirrors a real-world precedent disclosed independently around the same period: the "Meccha Chameleon" Steam Workshop incident (reported 23 J
Weaknesses (CWE)
CWE-190, CWE-122, CWE-787, CWE-131
Target sectors: gaming, entertainment, consumersoftware
Target regions: Global
Detections & IOCs
As of 2026-08-17, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 29 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, T1592.002, T1592.004, T1595.002, T1588.006, T1588.002, T1587.004, T1587.001, T1608.001, T1195.002, T1204.002
