Heap Buffer Overflow in Freeciv Savegame Files

Executive Summary

CVE-2026-90556 is a heap buffer overflow in Freeciv versions before 3.2.6. It occurs in the worklist_load() function when processing savegame files with worklist lengths over 64 elements. Attackers can create malicious save files that write past the fixed-size array into adjacent heap memory, potentially corrupting critical data structures.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Freeciv savegame files for worklist lengths exceeding 64 elements. Check server logs for malformed savegame files or crashes during loading. Use static analysis tools to scan savegame3.c for improper bounds checking in worklist_load().

Commands: grep -r 'worklist_load' /path/to/freeciv/source/; check savegame file headers for wl_length values > 64; monitor server logs for heap corruption errors.

Useful 0 Not Useful 0

Impact Analysis

If you load a malicious savegame file, this vulnerability could corrupt memory, leading to crashes or arbitrary code execution. For single-player users, it may cause game instability. For multiplayer servers, it could allow attackers to disrupt gameplay or execute malicious code on the server.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Freeciv to version 3.2.6 or later, which includes bounds checking in worklist_load(). Avoid loading untrusted savegame files. Implement file integrity checks for savegames. Restrict access to savegame directories.

If upgrading is not possible, manually patch savegame3.c to enforce MAX_LEN_WORKLIST (64) checks in worklist_load(). Disable networked savegame sharing until patched.

Useful 0 Not Useful 0