CVE-2026-90557: 
Freeciv vulnerability analysis and mitigation

CVE-2026-90557 is an out-of-bounds read vulnerability in Freeciv versions 3.1.0 through 3.2.5, affecting the sg_load_player_unit() function in the savegame loading subsystem. When processing savegame files, the function uses a unit activity index (ei) read from the file to index into the activities.order[] array without validating that the index falls within the array's bounds. This allows a crafted savegame with an out-of-range activity index to bypass bounds checking, potentially causing a crash or limited heap memory exposure. The vulnerability was disclosed on September 12, 2026, and carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, VulnCheck).

The root cause is classified as CWE-125 (Out-of-bounds Read). In both savegame2.c (around line 4282) and savegame3.c (around line 6108), the vulnerable code reads an integer ei from the savegame file and directly uses it as an index into loading->activities.order[ei] without first checking whether ei is within the valid range [0, loading->activities.size). An attacker can craft a savegame file containing a negative or excessively large activity index value, causing the application to read memory outside the allocated activities.order heap buffer. The attack vector is local and requires user interaction — the victim must open the malicious savegame file — but no privileges are required (GitHub Commit, savegame3.c source, savegame2.c source).

Successful exploitation can result in a denial of service (application crash) or limited exposure of heap memory contents. The confidentiality impact is low — only a small, unpredictable portion of heap memory adjacent to the activities.order buffer may be disclosed — while integrity is unaffected. The primary risk is availability, as the out-of-bounds read is likely to trigger a segmentation fault and crash the Freeciv client or server process. There is no evidence of lateral movement potential or significant data exfiltration risk given the constrained memory exposure (GitHub Advisory, VulnCheck).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, reflecting very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The vulnerability was reported by researcher Tristan See via the Freeciv bug tracker (RM #2162) (GitHub Commit, GitHub Advisory).

1. Craft a malicious savegame file: Using a hex editor or a custom script, create or modify a Freeciv savegame file (.sav or .sav.gz) to set a unit's activity field to an integer value outside the valid range of the activities.order array (e.g., a large positive integer or a negative value such as -1 or 9999).
2. Identify a target: Locate a user or server running Freeciv 3.1.0 through 3.2.5. This could be a local user or a multiplayer server that accepts savegame uploads.
3. Deliver the malicious savegame: Distribute the crafted file via social engineering (e.g., sharing it as a game save on a forum or via direct message), or upload it to a server that auto-loads savegames.
4. Trigger savegame loading: Induce the victim to load the malicious savegame through the Freeciv client or server interface. The sg_load_player_unit() function in savegame2.c or savegame3.c will be invoked during the load process.
5. Out-of-bounds read occurs: The unvalidated ei index is used to access loading->activities.order[ei], reading memory outside the allocated buffer. This results in either a crash (denial of service) or, in some memory layouts, exposure of adjacent heap contents (GitHub Commit, VulnCheck).

• Logs: Freeciv server or client logs containing the message "Invalid activity id for unit <N>" (introduced by the patch as a warning for out-of-range indices); unexpected "Failure loading savegame!" log entries.
• Process: Freeciv client or server process terminating unexpectedly with a segmentation fault (SIGSEGV) or similar memory access error immediately after loading a savegame file.
• File System: Presence of unexpected or externally sourced .sav or .sav.gz savegame files in the Freeciv save directory; savegame files with anomalously large or negative integer values in unit activity fields when inspected with a text editor (savegames are text-based section files).
• Network: On multiplayer servers, unexpected savegame upload or load requests from unknown or untrusted clients shortly before a server crash.

Freeciv 3.2.6 addresses this vulnerability by adding bounds checking in sg_load_player_unit() in both savegame2.c and savegame3.c: the activity index ei is now validated to be within [0, loading->activities.size) before use, and invalid indices are logged and defaulted to ACTIVITY_IDLE. Users should upgrade to Freeciv 3.2.6 or later as the primary remediation (Freeciv Release R3_2_6, GitHub Commit). If immediate upgrading is not possible, restrict savegame loading to files from trusted sources only, and avoid loading savegames received from unknown parties.