Executive brief
Freeciv is a free, open-source strategy game that supports loading saved game files. A vulnerability in the savegame loading logic allows attackers to craft malicious game files that trigger a heap buffer overflow when loaded by a user or server administrator. Successful exploitation could corrupt memory and potentially lead to code execution, allowing an attacker to compromise a system running the game.
Technical details
The vulnerability is a heap buffer overflow in the worklist_load() function within the savegame parsing code (savegame2.c). The vulnerable code declares a fixed-size array for worklist entries with a bound of 64 elements, but fails to validate that the worklist length field in the savegame file does not exceed this bound. An attacker can craft a malicious savegame file with a declared worklist length greater than 64, causing the parser to write past the array boundary into adjacent heap-allocated structures. This memory corruption occurs during savegame file deserialization when the file is opened by a user or server operator. A fix is available in version 3.2.6 and later.
Affected products
- Freeciv Freeciv before 3.2.6
Timeline
- 2026-09-12: disclosed
- 2026-09-12: patched: Fixed in version 3.2.6