CVE-2026-90557: Freeciv 3.1.0 through 3.2.5 Out-of-Bounds Read via Savegame
Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vulnerability in sgloadplayerunit() when processing savegame files with invalid unit activity indices. An attacker can craft a malicious savegame file with an out-of-range activity index that bypasses bounds checking and causes a crash or limited heap memory exposure when loaded.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Freecivto a version that resolves this vulnerability.Fixed in 3.2.5
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Freeciv 3.1.0 through 3.2.5 are exposed when they load a savegame file. The issue is triggered by savegames containing an invalid unit activity index.
What must an attacker do to exploit the vulnerability?
An attacker must craft a malicious savegame with an out-of-range activity index and have it loaded by the affected Freeciv installation. The attack requires user interaction, as indicated by the UI:R vector.
What is the likely impact after loading a malicious savegame?
Loading the crafted savegame can cause a crash or expose a limited amount of heap memory. The supplied severity vector indicates low confidentiality impact, no integrity impact, and high availability impact.
How can I determine whether an instance is affected?
Check whether the Freeciv version is between 3.1.0 and 3.2.5 and whether users load savegame files from untrusted sources. Affected processing occurs in sg_load_player_unit() when a savegame contains an invalid unit activity index.