Executive brief
Freeciv is a turn-based strategy game that supports loading saved game files. Versions 3.1.0 through 3.2.5 contain a flaw that allows an attacker to craft a malicious savegame file causing the game to crash or expose heap memory when loaded. This could disrupt multiplayer game sessions or expose sensitive information from the game server's memory.
Technical details
An out-of-bounds read vulnerability exists in the sg_load_player_unit() function within the savegame loading code (savegame2.c). The vulnerability occurs when processing savegame files containing invalid unit activity indices that bypass bounds checking. An attacker can craft a malicious savegame file with an out-of-range activity index that, when loaded by versions 3.1.0 through 3.2.5, triggers the out-of-bounds read. This can result in a crash (denial of service) or limited exposure of heap memory contents. No user interaction beyond loading the file is required, but the attacker must be able to deliver the malicious savegame file to the victim.
Affected products
- Freeciv Freeciv 3.1.0 through 3.2.5
Timeline
- 2026-09-12: disclosed