EUVD-2026-76901
GHSA-2p7g-gcvc-7p6m
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
File must be explicitly loaded (AV:L, UI:R); no attacker privileges required to craft the malicious savegame; full heap corruption enables C/I/A:H with no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Freeciv versions before 3.2.6 contain a heap buffer overflow in worklist_load() when processing savegame files with declared worklist lengths exceeding the fixed array bound of 64 elements. Attackers can craft malicious savegame files that write past the entries array into adjacent heap-allocated struct fields, potentially corrupting memory when a user or server operator loads the file.
AnalysisAI
Heap buffer overflow in Freeciv's worklist_load() function allows memory corruption when a crafted savegame file declares a worklist length exceeding the fixed MAX_LEN_WORKLIST bound of 64 entries. Both savegame format v2 (savegame2.c) and v3 (savegame3.c) code paths are vulnerable in all releases before 3.2.6, meaning any user or server operator who loads a malicious .sav file may have heap-adjacent struct fields overwritten, potentially enabling arbitrary code execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must explicitly load a crafted savegame file - either through the Freeciv client's single-player load dialog or via a multiplayer game server that processes an externally supplied savegame. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.5 (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) is consistent with a file-parsing heap overflow: local access and passive user interaction are required, but if those conditions are met, full C/I/A compromise of the vulnerable system is plausible. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Freeciv 3.2.6, available at https://github.com/freeciv/freeciv/releases/tag/R3_2_6. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Freeciv installations and restrict loading of .sav files from untrusted sources, especially in multiplayer environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Freeciv before 2.6.7 and before 3.0.3 is prone to a buffer overflow vulnerability in the Modpack Installer utility's han
Out-of-bounds read in Freeciv 3.1.0-3.2.5 allows a crash or limited heap memory exposure when a user loads a maliciously
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today