Skip to navigation

Threat reportVulnerabilityTL-2026-5832

Titan Quest: Anniversary Edition heap overflow in .lvl/.pfx file parsing exploited via malicious custom maps (no CVE)

mediumTRACKING

Synacktiv researcher Thomas Dubier disclosed heap overflows in Engine.dll of Titan Quest: Anniversary Edition v2.10.21415 (GOG), reachable by loading a crafted .lvl level file or .pfx particle-effect file. A working code-execution chain was demonstrated on Windows 11, with shared community maps and assets as the delivery vector. First disclosed .

Key facts

IdentifiersTL-2026-5832
Also known asExploiting Titan Quest
SeverityMEDIUM
First disclosed
Affected productsTHQ Nordic Titan Quest: Anniversary Edition (Engine.dll)
Weaknesses (CWE)CWE-190, CWE-122, CWE-787
ToolsArcExplorer, Editor.exe, MapCompiler.exe, PSEditor.exe, System Informer, UPX
MITRE ATT&CK techniquesT1195 Supply Chain Compromise, T1195.002 Supply Chain Compromise: Compromise Software Supply Chain, T1203 Exploitation for Client Execution, T1204 User Execution, T1204.002 User Execution: Malicious File, T1518 Software Discovery, T1587.004 Develop Capabilities: Exploits, T1588.005 Obtain Capabilities: Exploits
MotivationUNKNOWN
Target sectorsgaming, consumer
Target regionsGlobal
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5832 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Titan Quest Malicious Map/Asset Staged in custommaps Folder (Exploitation)

Behaviour-first detection of the delivery step for the Titan Quest Engine.dll heap overflows disclosed by Synacktiv (no CVE). Fires when a .lvl, .pfx, .map, .wrl or .arc file lands in the Documents\My Games\Titan Quest - Immortal Throne\custommaps folder from a process that is not the game or its official editors (browser, archiver, script host). A crafted .lvl (chunk 03h, GAME::ImpassableData::Load width*height overflow) or .pfx (GAME::EmitterData::InternalBinaryRead) is parsed when the map is loaded (T1204.002, T1195.002).

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 TargetFilename="*\\Titan Quest*\\custommaps\\*" earliest=-24h
| where match(lower(TargetFilename), "\.(lvl|pfx|map|wrl|arc)$")
| where NOT match(lower(Image), "(^|[^a-z0-9_])(tq|titanquest|editor|mapcompiler|pseditor)\.exe$")
| stats count AS file_events dc(TargetFilename) AS distinct_files values(TargetFilename) AS staged_files min(_time) AS first_seen max(_time) AS last_seen BY Computer, User, Image
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| table Computer User Image distinct_files staged_files first_seen last_seen file_events

Microsoft KQL

let GameFileExt = @"\.(lvl|pfx|map|wrl|arc)$";
let Staging = DeviceFileEvents
    | where Timestamp > ago(24h)
    | where ActionType in ("FileCreated", "FileModified", "FileRenamed")
    | where FolderPath has "custommaps" and FolderPath has "Titan Quest"
    | where tolower(FileName) matches regex GameFileExt
    | where InitiatingProcessFileName !in~ ("TQ.exe", "TitanQuest.exe", "Editor.exe", "MapCompiler.exe", "PSEditor.exe")
    | project Timestamp, DeviceName, Account = InitiatingProcessAccountName, Signal = "map_asset_staged_by_non_game_process", FileName, Detail = FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine;
let Tooling = DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where (FileName in~ ("MapCompiler.exe", "PSEditor.exe", "Editor.exe") and FolderPath has "Titan Quest") or FileName =~ "ArcExplorer.exe"
    | project Timestamp, DeviceName, Account = AccountName, Signal = "exploit_crafting_tooling_executed", FileName, Detail = ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine;
union Staging, Tooling
| order by Timestamp desc

Sigma

title: Titan Quest Custom Map or Asset File Staged by Non-Game Process
id: 5b0c3f1e-7a42-4d1b-9c58-2e6a91d4b001
status: experimental
description: Detects lvl, pfx, map, wrl or arc files written into the Titan Quest custommaps folder by a process other than the game or its official editors. Crafted level and particle files can trigger heap overflows in Engine.dll when loaded. No CVE is assigned.
references:
    - https://www.synacktiv.com/en/publications/exploiting-titan-quest.html
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.initial-access
    - attack.t1195.002
    - attack.execution
    - attack.t1204.002
    - attack.t1204
logsource:
    category: file_event
    product: windows
detection:
    selection_path:
        TargetFilename|contains: '\custommaps\'
    selection_ext:
        TargetFilename|endswith:
            - '.lvl'
            - '.pfx'
            - '.map'
            - '.wrl'
            - '.arc'
    filter_game:
        Image|endswith:
            - '\TQ.exe'
            - '\TitanQuest.exe'
            - '\Editor.exe'
            - '\MapCompiler.exe'
            - '\PSEditor.exe'
    condition: selection_path and selection_ext and not filter_game
falsepositives:
    - Players manually copying community maps with explorer.exe or an archive tool
    - Mod managers or sync tools restoring custommaps content
level: medium

Known false positives:

  • Players copying community maps with explorer.exe or an archive extractor
  • Mod managers restoring custommaps content
  • Legitimate map authors saving from tools not on the allow-list

Tuning notes: Requires Sysmon EventCode 11 (FileCreate) coverage for the custommaps path. Exclude explorer.exe and approved mod-manager images on gaming-focused hosts, or keep them to catch manual map drops. Raise priority when the staging process is a browser, mail client or script host. Adjust the Titan Quest path pattern if the game is installed outside the default GOG layout.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Titan Quest Malicious Map/Asset Staging and Crafting Tooling (Exploitation) [KQL] · unlock with TL Creds
  • Titan Quest Game Process Spawning Shell or Discovery Children (Post-Exploitation) [KQL] · unlock with TL Creds
  • Titan Quest Game Process Outbound Public Connections (C2 Hunt) [KQL] · unlock with TL Creds
  • Titan Quest Malicious Map/Asset Staged in custommaps Folder (Exploitation) [Sigma] · unlock with TL Creds
  • Titan Quest Game Process Spawning Shell or Discovery Children (Post-Exploitation) [Sigma] · unlock with TL Creds
  • Titan Quest Game Process Outbound Public Connections (C2 Hunt) [Sigma] · unlock with TL Creds
  • Titan Quest Game Process Spawning Shell or Discovery Children (Post-Exploitation) · unlock with TL Creds
  • Titan Quest Game Process Outbound Public Connections (C2 Hunt) · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-5832.

16 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

No CVE, in-the-wild exploitation, or patch is reported.

Synacktiv's 'Exploiting Titan Quest' (published 2026-07-29) analyses the map and asset parsers of Titan Quest: Anniversary Edition (THQ Nordic's 2016 re-release of the original Iron Lore/THQ game), tested on the GOG build v2.10.21415 under Windows 11 Professional build 10.0.26200. The game is a 32-bit process, and some of its bundled DLLs do not opt in to ASLR. The author notes that 49 methods in Engine.dll take a 16-byte GAME::BinaryReader structure, making binary game-file parsing a large attack surface. The GOG install bundles developer tools (Editor.exe for .wrl worlds, MapCompiler.exe to compile .map files, PSEditor.exe for .pfx particle effects) and the custom-maps folder sits under Documents\My Games\Titan Quest - Immortal Throne\custommaps on the test system.

Vulnerability 1 is in GAME::ImpassableData::Load, which parses chunk type 03h (CHUNK_TYPE_IMPASSABLE_DATA) of a .lvl level file. The destination buffer size is computed as width * height, which can overflow 32 bits, and the 'count' of bytes subsequently copied from the file is never checked against that allocation, producing a heap buffer overflow (CWE-190 integer overflow leading to CWE-122/CWE-787 heap/out-of-bounds write). Vulnerability 2 is a set of heap overflows in GAME::EmitterData::InternalBinaryRead, which parses .pfx files and copies several arrays of uncontrolled size into a fixed-size structure; the author judged these less exploitable because the allocation size itself is not attacker-controlled.

The research describes a multi-stage exploitation path built around the game's Segment Heap behaviour (allocations over 0x4000 bytes) and NT heap header XOR encoding. GAME::Water::Load (.lvl chunk 09h, CHUNK_TYPE_WATER) accepts variable-length WaterType strings, letting the researcher groom the heap into a predictable layout so the vulnerable impassable-data buffer lands adjacent to a Level object; a follow-on water chunk then causes an object teardown path (GAME::Level::NewWater / GAME::Water::~Water) to dereference attacker-influenced memory, yielding a hijacked indirect call. The write-up separately describes a documented technique for working around 32-bit ASLR in this process by filling address space with large repeated string allocations (WaterLayer objects) to make certain addresses predictable, and references a found code sequence reachable through this layout that can pivot execution. From there the article describes marking heap memory executable and ultimately running attacker-supplied code in the game process. Synacktiv states this chain was demonstrated end-to-end on a Windows 11 VM (build 10.0.26200) with a linked demonstration video, but does not publish a complete, directly reusable PoC.

The delivery vector is user-supplied content: custom maps and asset archives (.map, .lvl, .pfx, .arc, extractable with the ArcExplorer tool) are manually placed in the custommaps folder and shared informally within the modding community (e.g. via forums such as TitanQuestFans). Exploitation requires a victim to install and load an attacker-supplied map or asset bundle; code then runs with that user's privileges. The article states no CVE, CVSS score, in-the-wild exploitation, or attribution. The researcher began the vulnerability search 2026-03-23, contacted the publisher 2026-04-15, followed up 2026-05-02, and the article does not describe any vendor response or patch status as of publication (2026-07-29). Severity is analyst-assigned given the lack of a CVSS score in the source.

MITRE ATT&CK techniques by tactic:

Initial Access

T1195 Supply Chain Compromise; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain

Execution

T1203 Exploitation for Client Execution; T1204 User Execution; T1204.002 User Execution: Malicious File

Discovery

T1518 Software Discovery

Resource Development

T1587.004 Develop Capabilities: Exploits; T1588.005 Obtain Capabilities: Exploits

Remediation

Patches

  • No vendor patch or advisory is reported in the source; check the GOG and Steam release notes for builds newer than 2.10.21415

Immediate actions

  • Do not load custom maps, mods, or asset archives (.map, .lvl, .pfx, .arc) from untrusted sources
  • Review the Documents\My Games\Titan Quest - Immortal Throne\custommaps folder and remove unrecognised content
  • Run the game under a standard (non-administrator) account

Workarounds

  • Play without custom maps, or only with content from trusted, known creators
  • Where the game is installed on corporate endpoints, restrict it or isolate it from sensitive resources

Longer-term hardening

  • Monitor THQ Nordic and GOG release notes for a fix to Engine.dll map and asset parsing
  • Alert on unexpected child processes or network connections from the Titan Quest game process on managed endpoints
  • Treat community-shared game mods/maps as untrusted executable-adjacent content in enterprise software policy

Affected and fixed versions

  • THQ Nordic — Titan Quest: Anniversary Edition (Engine.dll)
    Vulnerable versions: 2.10.21415 (GOG, tested on Windows 11 Professional 10.0.26200)

Timeline

  • Synacktiv researcher Thomas Dubier begins vulnerability research on Titan Quest: Anniversary Edition map and asset parsers (start of vulnerability search per the article)
  • Initial contact made with the publisher about the findings
  • No further vendor communication is documented after the follow-up, leaving the issue unresolved as of publication
  • Follow-up sent to the publisher; the source does not describe any response
  • Publication states no CVE identifier, CVSS score, or patch status is associated with the findings
  • Article describes a working exploit chain demonstrated end-to-end on a Windows 11 VM (heap grooming, control-flow hijack, ASLR bypass, code execution) and links a demonstration video
  • Synacktiv publishes 'Exploiting Titan Quest' describing the heap overflows in GAME::ImpassableData::Load and GAME::EmitterData::InternalBinaryRead

Sources cited

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats