Read the docs
TI-2026-61570 Aliases CVE-2026-90556GHSA-2p7g-gcvc-7p6m

Freeciv before 3.2.6 Heap Buffer Overflow via worklist_load

Priority LOW 38CWE-122Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.

Summary

Freeciv versions before 3.2.6 contain a heap buffer overflow in worklist_load() when processing savegame files with declared worklist lengths exceeding the fixed array bound of 64 elements. Attackers can craft malicious savegame files that write past the entries array into adjacent heap-allocated struct fields, potentially corrupting memory when a user or server operator loads the file.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00202 10th percentileScored 2026-11-07
Fix Fixed freeciv (freeciv): 3.2.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
freecivfreecivbefore 3.2.63.2.6Patch availableCNA
  • freeciv Vendorfreeciv Affected before 3.2.6 Fixed in 3.2.6 Patch available CNA

Remediation

  • Fix · CNA freeciv (freeciv) Fixed in 3.2.6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    freeciv 3.2.6

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-61571 Freeciv 3.1.0 through 3.2.5 Out-of-Bounds Read via SavegamePriority LOW 30
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-90556
  2. 2026-10-03 Alias added: GHSA-2p7g-gcvc-7p6m

References

Patch 1

Other 5

  • TI-2010-02348 freeciv 2.2 before 2.2.1 and 2.3 before 2.3.0 allows attackers to read arbitrary files or… CVSS 2.0HIGH 10.0
  • TI-2012-05047 Freeciv before 2.3.3 allows remote attackers to cause a denial of service via a crafted packet. CVSS 3.1HIGH 7.5
  • TI-2022-18439 Freeciv before 2.6.7 and before 3.0.3 is prone to a buffer overflow vulnerability in the… CVSS 3.1HIGH 8.8
  • TI-2006-03789 Buffer overflow in Freeciv 2.1.0-beta1 and earlier, and SVN 15 Jul 2006 and earlier… CVSS 2.0HIGH 7.5
  • TI-2012-04746 Uncontrolled resource consumption in freeciv CVSS 3.1HIGH 7.5
  • TI-2006-00042 packets.c in Freeciv 2.0 before 2.0.8 allows remote attackers to cause a denial of… CVSS 2.0MEDIUM 5.0
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences