Out-of-Bounds Read in Freeciv Savegame Files

Executive Summary

CVE-2026-90557 is an out-of-bounds read vulnerability in Freeciv versions 3.1.0 through 3.2.5. It occurs in the sg_load_player_unit() function when processing savegame files with invalid unit activity indices. The vulnerability allows an attacker to craft a malicious savefile with an out-of-range activity index, bypassing bounds checking and causing a crash or limited heap memory exposure when loaded.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Freeciv savegame files for invalid unit activity indices. Check if the game version is between 3.1.0 and 3.2.5. Use commands like 'strings savegame.sav | grep -i activity' to examine activity indices. If the game crashes when loading a savefile, it may indicate exploitation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to crash the Freeciv game client or server when loading a malicious savefile. It may also expose limited heap memory contents, potentially leaking sensitive data. Users running affected versions should update to version 3.2.6 or later to mitigate the risk.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Freeciv to version 3.2.6 or later. If upgrading is not possible, avoid loading untrusted savegame files. Implement file integrity checks for savegames. Monitor for crashes when loading savefiles as a potential indicator of exploitation.

Useful 0 Not Useful 0