CVE-2026-90556

Freeciv versions before 3.2.6 contain a heap buffer overflow in the worklist_load() function, which parses worklist data embedded in savegame files. The parser trusts a declared worklist length from the file and writes past the fixed 64-element entries array into adjacent heap-allocated struct fields when that declared length exceeds the bound. An attacker who convinces a player or server operator to load a maliciously crafted savegame can corrupt heap memory in the game or server process, causing a crash and potentially achieving code execution with the privileges of that process. Anyone running a Freeciv client or server older than 3.2.6 who loads savegames from untrusted sources is affected; exploitation in the wild is not known, no public PoC exists, and the flaw is not on the CISA KEV list.

What to do: Upgrade to Freeciv 3.2.6 or later, or apply your distribution's patched package. Do not load savegame files from untrusted or unknown sources, and on multi-user game servers, restrict who may submit savegames for loading. If you run a fork or derivative (for example, Freeciv-web) that shares this savegame parser, verify whether it has picked up the fix.