CVE-2026-90556: Freeciv before 3.2.6 Heap Buffer Overflow via worklist_load
Freeciv versions before 3.2.6 contain a heap buffer overflow in worklistload() when processing savegame files with declared worklist lengths exceeding the fixed array bound of 64 elements. Attackers can craft malicious savegame files that write past the entries array into adjacent heap-allocated struct fields, potentially corrupting memory when a user or server operator loads the file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
freecivto a version that resolves this vulnerability.Fixed in 3.2.6Patch Heap Buffer Overflow via worklist_load
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users and server operators running Freeciv before 3.2.6 are exposed when they load a crafted savegame file. Exploitation requires local interaction because an attacker must get a malicious savegame loaded.
What must an attacker provide to trigger the overflow?
The attacker needs a savegame whose declared worklist length exceeds the fixed 64-element entries array bound. Loading that file causes worklist_load() to write beyond the array into adjacent heap-allocated fields.
What is the practical impact if exploitation succeeds?
The overflow can corrupt heap memory, including adjacent structure fields. The stated impact includes potential compromise of confidentiality, integrity, and availability.
How can I determine whether an installation is affected?
Check the installed Freeciv version. Versions before 3.2.6 are affected; version 3.2.6 is the stated fixed version.