---
id: CVE-2026-90556
title: >-
  Freeciv versions before 3.2.6 contain a heap buffer overflow in
  worklist_load() when processing savegame files with declared worklist lengths
  exceeding the fixed array bound of 64 elements
summary: >-
  Freeciv versions before 3.2.6 contain a heap buffer overflow in
  worklist_load() when processing savegame files with declared worklist lengths
  exceeding the fixed array bound of 64 elements. Attackers can craft malicious
  savegame files th…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-122
vendor: freeciv
product: freeciv
affected:
  - freeciv < 3.2.6
published: '2026-09-12'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:44.267'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90556'
references:
  - url: 'https://github.com/freeciv/freeciv'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/freeciv/freeciv/blob/R3_2_5/server/savegame/savegame2.c#L788
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/freeciv/freeciv/blob/R3_2_5/server/savegame/savegame3.c#L964
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/freeciv/freeciv/commit/75ecde3e86ddf2fe775768450e9a290a4f4d4387
    label: disclosure@vulncheck.com
  - url: 'https://github.com/freeciv/freeciv/releases/tag/R3_2_6'
    label: disclosure@vulncheck.com
  - url: 'https://redmine.freeciv.org/issues/2161'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/freeciv-before-3.2.6-heap-buffer-overflow-via-worklist-load
    label: disclosure@vulncheck.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90556.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-90556'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-90556'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00202
epssPercentile: 0.08861
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-18T17:12:30.735572Z'
ingestedAt: '2026-09-14T15:23:07.478Z'
---

## Overview

Freeciv versions before 3.2.6 contain a heap buffer overflow in worklist_load() when processing savegame files with declared worklist lengths exceeding the fixed array bound of 64 elements. Attackers can craft malicious savegame files that write past the entries array into adjacent heap-allocated struct fields, potentially corrupting memory when a user or server operator loads the file.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90556.json)