CVE-2026-90556
Freeciv before 3.2.6 Heap Buffer Overflow via worklist_load
CVSS Score
7.8
EPSS Score
0.0%
EPSS Percentile
0th
Freeciv versions before 3.2.6 contain a heap buffer overflow in worklist_load() when processing savegame files with declared worklist lengths exceeding the fixed array bound of 64 elements. Attackers can craft malicious savegame files that write past the entries array into adjacent heap-allocated struct fields, potentially corrupting memory when a user or server operator loads the file.
| CWE | CWE-122 |
| Vendor | freeciv |
| Product | freeciv |
| Published | Sep 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for freeciv freeciv
Be the first to know when new high vulnerabilities affecting freeciv freeciv are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
freeciv / freeciv
0 < 3.2.6
References
github.com: https://github.com/freeciv/freeciv/commit/75ecde3e86ddf2fe775768450e9a290a4f4d4387 github.com: https://github.com/freeciv/freeciv redmine.freeciv.org: https://redmine.freeciv.org/issues/2161 github.com: https://github.com/freeciv/freeciv/blob/R3_2_5/server/savegame/savegame3.c#L964 github.com: https://github.com/freeciv/freeciv/releases/tag/R3_2_6 github.com: https://github.com/freeciv/freeciv/blob/R3_2_5/server/savegame/savegame2.c#L788 vulncheck.com: https://www.vulncheck.com/advisories/freeciv-before-3.2.6-heap-buffer-overflow-via-worklist-load
Credits
Tristan Madani