{"id":"CVE-2026-90556","summary":"Freeciv before 3.2.6 Heap Buffer Overflow via worklist_load","details":"Freeciv versions before 3.2.6 contain a heap buffer overflow in worklist_load() when processing savegame files with declared worklist lengths exceeding the fixed array bound of 64 elements. Attackers can craft malicious savegame files that write past the entries array into adjacent heap-allocated struct fields, potentially corrupting memory when a user or server operator loads the file.","modified":"2026-09-14T08:02:10.159047Z","published":"2026-09-12T18:06:41.013Z","database_specific":{"cwe_ids":["CWE-122"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90556.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90556.json"},{"type":"ADVISORY","url":"https://github.com/freeciv/freeciv/releases/tag/R3_2_6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90556"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/freeciv-before-3.2.6-heap-buffer-overflow-via-worklist-load"},{"type":"REPORT","url":"https://redmine.freeciv.org/issues/2161"},{"type":"FIX","url":"https://github.com/freeciv/freeciv/commit/75ecde3e86ddf2fe775768450e9a290a4f4d4387"},{"type":"PACKAGE","url":"https://github.com/freeciv/freeciv"},{"type":"ARTICLE","url":"https://github.com/freeciv/freeciv/blob/R3_2_5/server/savegame/savegame2.c#L788"},{"type":"ARTICLE","url":"https://github.com/freeciv/freeciv/blob/R3_2_5/server/savegame/savegame3.c#L964"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/freeciv/freeciv","events":[{"introduced":"0"},{"fixed":"2c4304c742aa81f1d73a5d604ed83237d57804a1"},{"fixed":"75ecde3e86ddf2fe775768450e9a290a4f4d4387"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"3.2.6"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["R3_2_5","R3_2_4","R3_2_3","R3_2_2","R3_2_1","R3_2_0","R3_2_0_RC2","R3_2_0_RC1","R3_2_0_beta2","R3_2_0_beta1","svn2git-trunk","S3_0-root","S2_6-root","S2_5-root","S2_4-root","S2_3-root","S2_2-root","S2_1-root","S2_0-root","S1_14-root","R1_13_0","gui-gtk","BEFORE_AGENTS","R1_12_0","R1_11_10","R1_11_8","R1_11_6","R1_11_4","R1_11_0","R1_10_0","R1_9_0","R1_8_3","R1_8_1","R1_8_0a","R1_7_2","R1_7_1","R1_7_0a","R1_6_4","R1_6_3","R1_6_2","R1_6_1","freeciv154","freeciv153"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90556.json","vanir_signatures_modified":"2026-09-14T08:02:10Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/freeciv/freeciv/commit/75ecde3e86ddf2fe775768450e9a290a4f4d4387","target":{"file":"server/savegame/savegame3.c"},"deprecated":false,"digest":{"line_hashes":["145569260306295611440174809323020358898","223795169114549000937506275359385185399","96087336979869061913287853794410278110","256682113116649861522241643137467803717","240913913477294091620435359600149161559","278840234656431935742604443681085718517","215072309832114462523449878007564490208","71111847577939048093964400627469600134"],"threshold":0.9},"id":"CVE-2026-90556-3ff5203f","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/freeciv/freeciv/commit/75ecde3e86ddf2fe775768450e9a290a4f4d4387","target":{"file":"server/savegame/savegame2.c","function":"worklist_load"},"deprecated":false,"digest":{"function_hash":"66802084563067900601456234301412794192","length":918},"id":"CVE-2026-90556-5243dbe6","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"66802084563067900601456234301412794192","length":918},"id":"CVE-2026-90556-9d168daa","signature_type":"Function","signature_version":"v1","source":"https://github.com/freeciv/freeciv/commit/75ecde3e86ddf2fe775768450e9a290a4f4d4387","target":{"file":"server/savegame/savegame3.c","function":"worklist_load"}},{"deprecated":false,"digest":{"function_hash":"115960299722060919881071125648431505203","length":2379},"id":"CVE-2026-90556-a8c8c46a","signature_type":"Function","signature_version":"v1","source":"https://github.com/freeciv/freeciv/commit/75ecde3e86ddf2fe775768450e9a290a4f4d4387","target":{"file":"server/savegame/savegame2.c","function":"sg_load_player_cities"}},{"deprecated":false,"digest":{"line_hashes":["145569260306295611440174809323020358898","223795169114549000937506275359385185399","96087336979869061913287853794410278110","256682113116649861522241643137467803717","240913913477294091620435359600149161559","257972707922949487644373089106459551248","216940496342591802850585554201551592836","17115285835530525128542121196818535273"],"threshold":0.9},"id":"CVE-2026-90556-c7afc301","signature_type":"Line","signature_version":"v1","source":"https://github.com/freeciv/freeciv/commit/75ecde3e86ddf2fe775768450e9a290a4f4d4387","target":{"file":"server/savegame/savegame2.c"}},{"target":{"file":"server/savegame/savegame3.c","function":"sg_load_player_cities"},"deprecated":false,"digest":{"length":2508,"function_hash":"143163770932370964497566368866646862163"},"id":"CVE-2026-90556-eb10d427","signature_type":"Function","signature_version":"v1","source":"https://github.com/freeciv/freeciv/commit/75ecde3e86ddf2fe775768450e9a290a4f4d4387"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}