CVE-2026-90556: 
Freeciv vulnerability analysis and mitigation

CVE-2026-90556 is a heap-based buffer overflow vulnerability in Freeciv's savegame parser that allows local code execution via crafted malicious save files. All Freeciv versions before 3.2.6 are affected. The flaw was disclosed on September 12, 2026, with a patch released in version 3.2.6. It carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 8.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). It resides in the worklist_load() function within both server/savegame/savegame2.c (around line 788) and server/savegame/savegame3.c (around line 964). When parsing a savegame file, the function reads the worklist length from the file (wl_length) without validating it against the fixed array bound of MAX_LEN_WORKLIST (64 elements). If a crafted savegame declares a length exceeding 64, the subsequent loop writes past the entries[] array boundary into adjacent heap-allocated struct fields, corrupting memory. The fix adds an explicit bounds check that clamps pwl->length to MAX_LEN_WORKLIST before the loop executes (Freeciv Commit, savegame3.c source).

Successful exploitation allows an attacker to corrupt heap memory and potentially execute arbitrary code with the privileges of the user or server operator who loads the malicious savegame file. This results in high confidentiality, integrity, and availability impact on the affected system. The attack is local in nature, requiring the victim to open a crafted file, but could affect both end users running the Freeciv client and server operators loading game saves (GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The NVD SSVC assessment confirms exploitation is "none" and the attack is not automatable, as it requires user interaction (a victim must load the malicious savegame). The EPSS score is approximately 0.139%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Red Hat Bugzilla).

1. Craft a malicious savegame file: Create or modify a Freeciv savegame file (.sav or .sav.gz) to set the wl_length field for a city's worklist to a value greater than 64 (e.g., 200), exceeding the MAX_LEN_WORKLIST constant.
2. Populate out-of-bounds entries: Populate the corresponding wl_kind and wl_value entries in the savegame file for indices 0 through the declared length, crafting the values to write controlled data into adjacent heap memory beyond the entries[] array.
3. Deliver the file to the target: Distribute the malicious savegame file to a target user or server operator through social engineering, a game-sharing platform, or a multiplayer scenario where save files are exchanged.
4. Trigger the overflow: The victim loads the crafted savegame in the Freeciv client or server. The worklist_load() function reads the inflated wl_length and iterates past the array boundary, writing attacker-controlled data into adjacent heap memory.
5. Achieve code execution: By carefully controlling the heap layout and the overwritten data (e.g., function pointers or metadata in adjacent heap chunks), an attacker may redirect execution flow to achieve arbitrary code execution with the privileges of the Freeciv process (Freeciv Commit, GitHub Advisory).

• File System: Presence of unexpected or externally sourced .sav or .sav.gz Freeciv savegame files with unusually large wl_length values (greater than 64) in the savegame data section.
• Logs: Freeciv server or client log output containing messages such as "worklist length X, while MAX_LEN_WORKLIST 64" (only present in patched versions); unexpected crashes or segmentation faults in the Freeciv process when loading a savegame.
• Process: Unexpected child processes spawned by the Freeciv client or server process (e.g., shells, network utilities) following a savegame load operation; abnormal memory usage or crashes in the Freeciv process.
• Network: Outbound connections from the Freeciv process to unknown external hosts shortly after loading a savegame file, which may indicate a successful post-exploitation reverse shell.

The primary remediation is to upgrade Freeciv to version 3.2.6 or later, which includes the fix that clamps the parsed worklist length to MAX_LEN_WORKLIST before processing entries (Freeciv Release R3_2_6, Freeciv Commit). As a workaround prior to patching, users should avoid loading savegame files from untrusted or unknown sources. Server operators should restrict which savegame files are loaded and consider implementing file integrity verification (e.g., checksums) before loading any externally provided saves (GitHub Advisory).

The vulnerability was reported by researcher Tristan (referenced in the commit message as RM #2161 on the Freeciv Redmine tracker) and assigned by VulnCheck. Coverage was limited to automated vulnerability tracking platforms and aggregators such as VulDB, Vulners, and ENISA's EUVD. A brief mention appeared on Mastodon via @thehackerwire. No significant vendor statements beyond the patch commit or notable researcher commentary beyond the initial report have been identified (GitHub Advisory, Freeciv Commit).