Description

Freeciv versions before 3.2.6 contain a heap buffer overflow in worklist_load() when processing savegame files with declared worklist lengths exceeding the fixed array bound of 64 elements. Attackers can craft malicious savegame files that write past the entries array into adjacent heap-allocated struct fields, potentially corrupting memory when a user or server operator loads the file.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-12T18:16:44.193Z",
  "pubdate": "2026-09-12T18:16:44.193Z",
  "executiveSummary": "Freeciv versions prior to 3.2.6 are susceptible to a heap-based buffer overflow vulnerability residing within the savegame parsing logic. The vulnerability is triggered during the processing of crafted savegame files that specify a worklist length exceeding the statically allocated boundary of 64 elements.\nThis memory corruption flaw allows an attacker to overwrite adjacent data fields within the heap, potentially leading to arbitrary code execution, unauthorized modification of application state, or denial-of-service conditions. The exploit requires the victim to load a malicious savegame file, making both server operators and client users vulnerable if they interact with untrusted game state data.\nThe risk is significant due to the nature of heap corruption, which bypasses basic input validation. Successful exploitation depends on the attacker's ability to supply a modified savegame file, which is then parsed by the vulnerable worklist_load() function. Organizations using Freeciv should prioritize updating to version 3.2.6 or later to eliminate the underlying heap-bound violation.",
  "technicalDetails": "The vulnerability originates in the worklist_load() function of Freeciv, which is responsible for deserializing worklist data structures from savegame files. The implementation employs a fixed-size array intended to store worklist entries, defined with a maximum capacity of 64 elements.\nThe flaw manifests due to insufficient bounds checking during the parsing process. When the application reads the length header from a savegame file, it fails to adequately validate the declared worklist length against the static heap-allocated buffer size. If an attacker provides a crafted savegame containing a length value greater than 64, the loop responsible for populating the entries array continues writing data beyond the allocated memory segment.\nBecause the entries array is located on the heap, this out-of-bounds write operation corrupts adjacent memory regions. Depending on the memory layout at the time of execution, the overflow can overwrite critical struct fields, pointers, or control flow metadata stored in neighboring heap objects. This corruption can be leveraged to alter the game's internal state or redirect execution flow by overwriting function pointers.\nThe attack flow follows a structured sequence: First, the attacker crafts a malicious savegame file by modifying the worklist length metadata to exceed 64 entries. Second, the attacker induces a target user or server instance to load this file. Third, the worklist_load() function initiates a heap allocation for the expected structure and proceeds to read data from the file into the entries array. Finally, the unchecked iteration writes data past the end of the array, triggering the heap buffer overflow and resulting in memory corruption.\nAffected versions include all Freeciv releases prior to 3.2.6. The exploitation is technically feasible without authentication provided the user/operator can be convinced to load the compromised file. Since savegame files are often exchanged in community settings, the attack surface includes any environment where external save files are processed. Post-exploitation, an attacker may achieve arbitrary code execution under the security context of the Freeciv process, leading to a complete compromise of the host system."
}