Freeciv
Monthly
Heap buffer overflow in Freeciv's worklist_load() function allows memory corruption when a crafted savegame file declares a worklist length exceeding the fixed MAX_LEN_WORKLIST bound of 64 entries. Both savegame format v2 (savegame2.c) and v3 (savegame3.c) code paths are vulnerable in all releases before 3.2.6, meaning any user or server operator who loads a malicious .sav file may have heap-adjacent struct fields overwritten, potentially enabling arbitrary code execution. No public exploit has been identified at time of analysis, but the patch diff is publicly available on GitHub, lowering the bar for future weaponization.
Out-of-bounds read in Freeciv 3.1.0-3.2.5 allows a crash or limited heap memory exposure when a user loads a maliciously crafted savegame file with an invalid unit activity index. The flaw exists in `sg_load_player_unit()` in both savegame2.c and savegame3.c, where the activity index `ei` is used to index into `loading->activities.order[]` without first validating it falls within `[0, loading->activities.size)`. No public exploit has been identified and the vulnerability is not on the CISA KEV list; vendor-released patch Freeciv 3.2.6 is available.
Freeciv before 2.6.7 and before 3.0.3 is prone to a buffer overflow vulnerability in the Modpack Installer utility's handling of the modpack URL. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
Heap buffer overflow in Freeciv's worklist_load() function allows memory corruption when a crafted savegame file declares a worklist length exceeding the fixed MAX_LEN_WORKLIST bound of 64 entries. Both savegame format v2 (savegame2.c) and v3 (savegame3.c) code paths are vulnerable in all releases before 3.2.6, meaning any user or server operator who loads a malicious .sav file may have heap-adjacent struct fields overwritten, potentially enabling arbitrary code execution. No public exploit has been identified at time of analysis, but the patch diff is publicly available on GitHub, lowering the bar for future weaponization.
Out-of-bounds read in Freeciv 3.1.0-3.2.5 allows a crash or limited heap memory exposure when a user loads a maliciously crafted savegame file with an invalid unit activity index. The flaw exists in `sg_load_player_unit()` in both savegame2.c and savegame3.c, where the activity index `ei` is used to index into `loading->activities.order[]` without first validating it falls within `[0, loading->activities.size)`. No public exploit has been identified and the vulnerability is not on the CISA KEV list; vendor-released patch Freeciv 3.2.6 is available.
Freeciv before 2.6.7 and before 3.0.3 is prone to a buffer overflow vulnerability in the Modpack Installer utility's handling of the modpack URL. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.