High severity · published Sep 12, 2026
CVE-2026-90556
Freeciv before 3.2.6 Heap Buffer Overflow via worklist_load
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
Freeciv versions before 3.2.6 contain a heap buffer overflow in worklist_load() when processing savegame files with declared worklist lengths exceeding the fixed array bound of 64 elements. Attackers can craft malicious savegame files that write past the entries array into adjacent heap-allocated struct fields, potentially corrupting memory when a user or server operator loads the file.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
freeciv · freeciv
before 3.2.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90556
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-90556
github.com
https://github.com/freeciv/freeciv
github.com
https://github.com/freeciv/freeciv/blob/R3_2_5/server/savegame/savegame2.c#L788
github.com
https://github.com/freeciv/freeciv/blob/R3_2_5/server/savegame/savegame3.c#L964
github.com
https://github.com/freeciv/freeciv/commit/75ecde3e86ddf2fe775768450e9a290a4f4d4387
github.com
https://github.com/freeciv/freeciv/releases/tag/R3_2_6
redmine.freeciv.org
https://redmine.freeciv.org/issues/2161
More from freeciv
8.8
CVE-2022-39047
Freeciv before 2.6.7 and before 3.0.3 is prone to a buffer overflow vulnerability in the Modpack Installer utility's handling of the modpack URL
7.5
CVE-2012-6083
Freeciv before 2.3.3 allows remote attackers to cause a denial of service via a crafted packet
7.5
CVE-2012-5645
A denial of service flaw was found in the way the server component of Freeciv before 2.3.4 processed certain packets
6.1
CVE-2026-90557
Freeciv 3.1.0 through 3.2.5 Out-of-Bounds Read via Savegame
–
CVE-2010-2445
freeciv 2.2 before 2.2.1 and 2.3 before 2.3.0 allows attackers to read arbitrary files or execute arbitrary commands via a scenario that contains Lua functionality, related to the…