CVE-2026-90556
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Freeciv versions before 3.2.6 contain a heap buffer overflow in worklist_load() when processing savegame files with declared worklist lengths exceeding the fixed array bound of 64 elements. Attackers can craft malicious savegame files that write past the entries array into adjacent heap-allocated struct fields, potentially corrupting memory when a user or server operator loads the file.
Risk Assessment
The vulnerability can lead to memory corruption and potential arbitrary code execution when a user or server operator loads a malicious savegame file, posing a threat to the integrity and availability of the game and system.
Recommendation
Update Freeciv to version 3.2.6 or later to fix the vulnerability.
Other vulnerabilities in Freeciv
Original NVD description (English source)
Freeciv versions before 3.2.6 contain a heap buffer overflow in worklist_load() when processing savegame files with declared worklist lengths exceeding the fixed array bound of 64 elements. Attackers can craft malicious savegame files that write past the entries array into adjacent heap-allocated struct fields, potentially corrupting memory when a user or server operator loads the file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS