EUVD-2026-76902
GHSA-m27m-5mqj-h84f
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local file-based trigger (AV:L) requires user to open malicious savegame (UI:R); no privilege needed to craft the file (PR:N); crash likely (A:H) with only limited adjacent heap read (C:L); no integrity impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vulnerability in sg_load_player_unit() when processing savegame files with invalid unit activity indices. An attacker can craft a malicious savegame file with an out-of-range activity index that bypasses bounds checking and causes a crash or limited heap memory exposure when loaded.
AnalysisAI
Out-of-bounds read in Freeciv 3.1.0-3.2.5 allows a crash or limited heap memory exposure when a user loads a maliciously crafted savegame file with an invalid unit activity index. The flaw exists in sg_load_player_unit() in both savegame2.c and savegame3.c, where the activity index ei is used to index into loading->activities.order[] without first validating it falls within [0, loading->activities.size). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim actively loads a crafted savegame file using Freeciv 3.1.0-3.2.5 - this constitutes the UI:P (passive user interaction) condition in the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.9 with vector AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H accurately characterises the attack profile: exploitation requires local file loading with passive user interaction (UI:P), yields a high availability impact (game crash), and only limited confidentiality exposure (bounded heap bytes adjacent to the activities array). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Freeciv 3.2.6, the confirmed patched release available at https://github.com/freeciv/freeciv/releases/tag/R3_2_6. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Freeciv before 2.6.7 and before 3.0.3 is prone to a buffer overflow vulnerability in the Modpack Installer utility's han
Heap buffer overflow in Freeciv's worklist_load() function allows memory corruption when a crafted savegame file declare
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today