CVE-2026-33250: Crash when receiving specially-crafted packets
Freeciv21 is a free open source, turn-based, empire-building strategy game. Versions prior to 3.1.1 crash with a stack overflow when receiving specially-crafted packets. A remote attacker can use this to take down any public server. A malicious server can use this to crash the game on the player's machine. Authentication is not needed and, by default, logs do not contain any useful information. All users should upgrade to Freeciv21 version 3.1.1. Running the server behind a firewall can help mitigate the issue for non-public servers. For local games, Freeciv21 restricts connections to the current user and is therefore not affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freecivto a version that resolves this vulnerability.Fixed in 3.0.6-1+deb12u1Fixed in 3.1.4+ds-2+deb13u1Fixed in 3.2.6+ds-1 - Upgrade
Upgrade
Freeciv21to a version that resolves this vulnerability.Fixed in 3.1.1 - Compensating control
Run the Freeciv21 server behind a firewall to help mitigate the issue for non-public servers.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33250?
CVE-2026-33250 is considered a critical vulnerability due to its potential to crash servers through specially-crafted packets.
How do I fix CVE-2026-33250?
To mitigate CVE-2026-33250, upgrade Freeciv21 to version 3.1.1 or later.
What versions of Freeciv21 are affected by CVE-2026-33250?
Versions of Freeciv21 prior to 3.1.1 are vulnerable to CVE-2026-33250.
What type of attack is possible with CVE-2026-33250?
A remote attacker can exploit CVE-2026-33250 to crash public servers using specially-crafted packets.
Is there a risk of data loss with CVE-2026-33250?
While the primary risk of CVE-2026-33250 is a server crash, there may also be potential for data loss if the server processes are affected.