CVE-2026-90556

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-90556
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90556.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-90556
Downstream
Published
2026-09-12T18:06:41Z
Modified
2026-09-14T08:02:10Z
Severity
  • 8.5 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Freeciv before 3.2.6 Heap Buffer Overflow via worklist_load
Details

Freeciv versions before 3.2.6 contain a heap buffer overflow in worklist_load() when processing savegame files with declared worklist lengths exceeding the fixed array bound of 64 elements. Attackers can craft malicious savegame files that write past the entries array into adjacent heap-allocated struct fields, potentially corrupting memory when a user or server operator loads the file.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-122"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90556.json"
}
References

Affected packages

Git / github.com/freeciv/freeciv

Affected ranges

Type
GIT
Repo
https://github.com/freeciv/freeciv
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2c4304c742aa81f1d73a5d604ed83237d57804a1
Fixed
75ecde3e86ddf2fe775768450e9a290a4f4d4387
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.2.6"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

Other
BEFORE_AGENTS
R1_10_0
R1_11_0
R1_11_10
R1_11_4
R1_11_6
R1_11_8
R1_12_0
R1_13_0
R1_6_1
R1_6_2
R1_6_3
R1_6_4
R1_7_0a
R1_7_1
R1_7_2
R1_8_0a
R1_8_1
R1_8_3
R1_9_0
R3_2_0
R3_2_0_RC1
R3_2_0_RC2
R3_2_0_beta1
R3_2_0_beta2
R3_2_1
R3_2_2
R3_2_3
R3_2_4
R3_2_5
S1_14-root
S2_0-root
S2_1-root
S2_2-root
S2_3-root
S2_4-root
S2_5-root
S2_6-root
S3_0-root
freeciv153
freeciv154
gui-gtk
svn2git-trunk

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90556.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "145569260306295611440174809323020358898",
                "223795169114549000937506275359385185399",
                "96087336979869061913287853794410278110",
                "256682113116649861522241643137467803717",
                "240913913477294091620435359600149161559",
                "278840234656431935742604443681085718517",
                "215072309832114462523449878007564490208",
                "71111847577939048093964400627469600134"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-90556-3ff5203f",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/freeciv/freeciv/commit/75ecde3e86ddf2fe775768450e9a290a4f4d4387",
        "target": {
            "file": "server/savegame/savegame3.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "66802084563067900601456234301412794192",
            "length": 918
        },
        "id": "CVE-2026-90556-5243dbe6",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/freeciv/freeciv/commit/75ecde3e86ddf2fe775768450e9a290a4f4d4387",
        "target": {
            "file": "server/savegame/savegame2.c",
            "function": "worklist_load"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "66802084563067900601456234301412794192",
            "length": 918
        },
        "id": "CVE-2026-90556-9d168daa",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/freeciv/freeciv/commit/75ecde3e86ddf2fe775768450e9a290a4f4d4387",
        "target": {
            "file": "server/savegame/savegame3.c",
            "function": "worklist_load"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "115960299722060919881071125648431505203",
            "length": 2379
        },
        "id": "CVE-2026-90556-a8c8c46a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/freeciv/freeciv/commit/75ecde3e86ddf2fe775768450e9a290a4f4d4387",
        "target": {
            "file": "server/savegame/savegame2.c",
            "function": "sg_load_player_cities"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "145569260306295611440174809323020358898",
                "223795169114549000937506275359385185399",
                "96087336979869061913287853794410278110",
                "256682113116649861522241643137467803717",
                "240913913477294091620435359600149161559",
                "257972707922949487644373089106459551248",
                "216940496342591802850585554201551592836",
                "17115285835530525128542121196818535273"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-90556-c7afc301",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/freeciv/freeciv/commit/75ecde3e86ddf2fe775768450e9a290a4f4d4387",
        "target": {
            "file": "server/savegame/savegame2.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "143163770932370964497566368866646862163",
            "length": 2508
        },
        "id": "CVE-2026-90556-eb10d427",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/freeciv/freeciv/commit/75ecde3e86ddf2fe775768450e9a290a4f4d4387",
        "target": {
            "file": "server/savegame/savegame3.c",
            "function": "sg_load_player_cities"
        }
    }
]
vanir_signatures_modified 
"2026-09-14T08:02:10Z"