CVE-2026-90556
Freeciv before 3.2.6 Heap Buffer Overflow via worklist_load
- State
- Published
- Severity
- 8.5 High
- Published
- Sep 12, 2026
- Updated
- Sep 18, 2026
- Reserved
- Sep 12, 2026
Description
Freeciv versions before 3.2.6 contain a heap buffer overflow in worklist_load() when processing savegame files with declared worklist lengths exceeding the fixed array bound of 64 elements. Attackers can craft malicious savegame files that write past the entries array into adjacent heap-allocated struct fields, potentially corrupting memory when a user or server operator loads the file.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.5 High | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.8 High | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-122 Heap-based Buffer Overflow
Affected Products
| Product | Versions |
|---|---|
freecivfreeciv |
|
References
- Patch Commitpatch
- https://github.com/freeciv/freecivproduct
- https://redmine.freeciv.org/issues/2161issue-tracking
- https://github.com/freeciv/freeciv/blob/R3_2_5/server/savegame/savegame3.c#L964technical-description
- freeciv R3_2_6 Release Notesrelease-notes
- https://github.com/freeciv/freeciv/blob/R3_2_5/server/savegame/savegame2.c#L788technical-description
- VulnCheck Advisory: Freeciv before 3.2.6 Heap Buffer Overflow via worklist_loadthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.