CVE Feed

    Dashboard / CVE / CVE-2026-90557

    CVE-2026-90557

    Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vulnerability in sg_load_player_unit() when processing savegame files with invalid unit activity indices. An attacker can craft a malicious savegame file with an out-of-range activity index that bypasses bounds checking and causes a crash or limited heap memory exposure when loaded.

    Published:Sep 12, 2026
    Last Modified:Sep 15, 2026
    EPS:Sep 12, 2026
    EPSS Score:0.00124
    CVSS Score:6.1

    Affected Products

    Vendor
    Freeciv
    Product
    Freeciv

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-125 Out-of-bounds Read

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-540 Overread Buffers

    Related CVEs

    CVE-2026-90556 (CVSS 8.5) — Freeciv versions before 3.2.6 contain a heap buffer overflow in worklist_load() when processing savegame files…
    CVE-2022-39047 (CVSS 8.8) — Freeciv before 2.6.7 and before 3.0.3 is prone to a buffer overflow vulnerability in the Modpack Installer uti…
    CVE-2012-6083 (CVSS 7.5) — Freeciv before 2.3.3 allows remote attackers to cause a denial of service via a crafted packet.…
    CVE-2012-5645 (CVSS 7.5) — A denial of service flaw was found in the way the server component of Freeciv before 2.3.4 processed certain p…
    CVE-2010-2445 (CVSS 10) — freeciv 2.2 before 2.2.1 and 2.3 before 2.3.0 allows attackers to read arbitrary files or execute arbitrary co…
    CVE-2006-3913 (CVSS 7.5) — Buffer overflow in Freeciv 2.1.0-beta1 and earlier, and SVN 15 Jul 2006 and earlier, allows remote attackers t…
    CVE-2006-0047 (CVSS 5) — packets.c in Freeciv 2.0 before 2.0.8 allows remote attackers to cause a denial of service (server crash) via …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-90557 — Freeciv (Medium 6.9) | CVE-DB