CVE-2026-90557 Overview
CVE-2026-90557 is an out-of-bounds read vulnerability [CWE-125] affecting Freeciv versions 3.1.0 through 3.2.5. The flaw resides in the sg_load_player_unit() function within the server's savegame loading logic. When Freeciv processes a savegame file, it reads a unit activity index without verifying that the index falls within the bounds of the loading->activities.order[] array.
An attacker who supplies a crafted savegame file with an out-of-range activity index can trigger a server crash or expose limited heap memory contents. The issue requires local file loading and user interaction to open the malicious savegame.
Critical Impact
A crafted Freeciv savegame can crash the game server or leak adjacent heap memory when loaded by a vulnerable client or server.
Affected Products
- Freeciv 3.1.0 through 3.2.5 (server savegame loader)
- server/savegame/savegame2.c code path
- server/savegame/savegame3.c code path
Discovery Timeline
- 2026-09-12 - CVE-2026-90557 published to NVD
- 2026-09-15 - Last updated in NVD database
Technical Details for CVE-2026-90557
Vulnerability Analysis
The vulnerability exists in the Freeciv server's savegame parser. Freeciv stores per-unit state, including the unit's current activity, inside a text-based savegame file. During load, sg_load_player_unit() calls secfile_lookup_int() to read an integer activity index ei from the savegame. That index is then used directly to dereference loading->activities.order[ei], which is passed to unit_activity_by_name().
The pre-patch code performs no validation that ei is non-negative or less than loading->activities.size. A negative or oversized index causes the loader to read outside the allocated activities.order[] array. The resulting pointer is dereferenced as a C string during the case-insensitive name comparison performed by fc_strcasecmp.
Depending on adjacent heap contents, the out-of-bounds read produces either a segmentation fault or a comparison against arbitrary memory. This can expose limited heap contents through observable game behavior or crash the server, denying service to connected players.
Root Cause
The root cause is missing bounds checking on attacker-controlled input read from a savegame file. The activity index is trusted after retrieval and used as an array subscript with no range validation, violating standard input validation practice for parsed data.
Attack Vector
Exploitation requires an attacker to deliver a malicious savegame file and convince a user or server operator to load it. This is a local attack vector with required user interaction. Public multiplayer servers that accept savegame uploads are also exposed.
// Source: https://github.com/freeciv/freeciv/commit/ef0c76c2765fe383140eb1a70dbea1228844152e
// Security patch in server/savegame/savegame2.c and savegame3.c
sg_warn_ret_val(secfile_lookup_int(loading->file, &punit->fuel,
"%s.fuel", unitstr), FALSE,
"%s", secfile_error());
+
sg_warn_ret_val(secfile_lookup_int(loading->file, &ei,
"%s.activity", unitstr), FALSE,
"%s", secfile_error());
- activity = unit_activity_by_name(loading->activities.order[ei],
- fc_strcasecmp);
+ if (ei >= 0 && ei < loading->activities.size) {
+ activity = unit_activity_by_name(loading->activities.order[ei],
+ fc_strcasecmp);
+ } else {
+ log_sg("Invalid activity id for unit %d", punit->id);
+ activity = ACTIVITY_IDLE;
+ }
punit->birth_turn
= secfile_lookup_int_default(loading->file, game.info.turn,
The patch adds an explicit range check on ei and falls back to ACTIVITY_IDLE while emitting a savegame warning when the index is invalid.
Detection Methods for CVE-2026-90557
Indicators of Compromise
- Unexpected crashes of the freeciv-server process shortly after a savegame load operation.
- Savegame files containing .activity integer values that are negative or exceed the declared activities.size.
- Savegame warnings referencing invalid activity ids in freeciv-server logs after applying the patched release.
Detection Strategies
- Parse untrusted .sav and .sav.gz files offline and flag any unit records where the activity field is out of range for the referenced activities ruleset.
- Monitor for segmentation faults or abnormal termination of freeciv-server correlated with savegame ingestion events.
- Track file provenance of savegames loaded by public Freeciv servers and treat externally supplied files as untrusted input.
Monitoring Recommendations
- Enable core dump collection and stack trace analysis for the freeciv-server binary in production or hosted environments.
- Alert on repeated crashes of the game server from the same client session, which may indicate exploitation attempts.
- Review upload directories and admin channels used to distribute savegames for anomalous file activity.
How to Mitigate CVE-2026-90557
Immediate Actions Required
- Upgrade Freeciv to release R3_2_6 or later, which contains the fix in commit ef0c76c2765fe383140eb1a70dbea1228844152e.
- Restrict savegame loading on multi-user or hosted servers to files from trusted sources only.
- Audit any existing savegame archives that will be reloaded after upgrade for anomalous activity indices.
Patch Information
The fix is committed to the Freeciv repository and released in tag R3_2_6. See the Freeciv commit ef0c76c, the Freeciv R3_2_6 release, the Freeciv issue tracker entry #2162, and the VulnCheck advisory for reference.
Workarounds
- Do not load savegame files received from untrusted players or third parties on affected Freeciv versions.
- Operate hosted Freeciv servers under process isolation and automatic restart supervision to limit denial-of-service impact.
- Disable or restrict features that allow remote users to upload or select arbitrary savegame files until the patched version is deployed.
# Build and install the patched Freeciv release
git clone https://github.com/freeciv/freeciv.git
cd freeciv
git checkout R3_2_6
./autogen.sh
make
sudo make install
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
