CVE-2026-90557

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-90557

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90557.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-90557

Downstream

Published

2026-09-12T18:06:41Z

Modified

2026-10-21T10:48:57Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Freeciv 3.1.0 through 3.2.5 Out-of-Bounds Read via Savegame

Details

Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vulnerability in sg_load_player_unit() when processing savegame files with invalid unit activity indices. An attacker can craft a malicious savegame file with an out-of-range activity index that bypasses bounds checking and causes a crash or limited heap memory exposure when loaded.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-125"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90557.json"
}

References

Affected packages

Git / github.com/freeciv/freeciv

Affected ranges

Type

GIT

Repo

https://github.com/freeciv/freeciv

Events

Introduced

fb42aab19c905043535a2724530b1663296d1094

Fixed

2c4304c742aa81f1d73a5d604ed83237d57804a1

Fixed

ef0c76c2765fe383140eb1a70dbea1228844152e

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "3.1.0"
                },
                {
                    "fixed":  "3.2.6"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "ef0c76c2765fe383140eb1a70dbea1228844152e"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "R3_2_6",
            "range":  [
                {
                    "fixed":  "2c4304c742aa81f1d73a5d604ed83237d57804a1"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90557.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "142849540890914642947336073642422789028",
                "24526726681450099116182917044600884785",
                "123498447269096563610112010971072554830",
                "270871661761673364773412692179972452556",
                "34500823245335621245519708511545872776",
                "79165094104425294332908834408909659687",
                "320975844593461283833904717075739841786",
                "273148677959842760557607899229372755427",
                "2858218428011500014421600424146629056"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-90557-bce4d12e",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/freeciv/freeciv/commit/ef0c76c2765fe383140eb1a70dbea1228844152e",
        "target":  {
            "file":  "server/savegame/savegame2.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "142849540890914642947336073642422789028",
                "24526726681450099116182917044600884785",
                "123498447269096563610112010971072554830",
                "270871661761673364773412692179972452556",
                "34500823245335621245519708511545872776",
                "79165094104425294332908834408909659687",
                "320975844593461283833904717075739841786",
                "273148677959842760557607899229372755427",
                "2858218428011500014421600424146629056"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-90557-cff6a576",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/freeciv/freeciv/commit/ef0c76c2765fe383140eb1a70dbea1228844152e",
        "target":  {
            "file":  "server/savegame/savegame3.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "8343527651414630177102357639070688699",
            "length":  14351
        },
        "id":  "CVE-2026-90557-d8b3d79f",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/freeciv/freeciv/commit/ef0c76c2765fe383140eb1a70dbea1228844152e",
        "target":  {
            "file":  "server/savegame/savegame2.c",
            "function":  "sg_load_player_unit"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "310829668914625744742061800927352017255",
            "length":  12313
        },
        "id":  "CVE-2026-90557-f0955c2f",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/freeciv/freeciv/commit/ef0c76c2765fe383140eb1a70dbea1228844152e",
        "target":  {
            "file":  "server/savegame/savegame3.c",
            "function":  "sg_load_player_unit"
        }
    }
]

vanir_signatures_modified

"2026-10-21T10:48:57Z"