Description

Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vulnerability in sg_load_player_unit() when processing savegame files with invalid unit activity indices. An attacker can craft a malicious savegame file with an out-of-range activity index that bypasses bounds checking and causes a crash or limited heap memory exposure when loaded.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-12T18:16:44.343Z",
  "pubdate": "2026-09-12T18:16:44.343Z",
  "executiveSummary": "An out-of-bounds read vulnerability has been identified in Freeciv, specifically affecting versions 3.1.0 through 3.2.5. The vulnerability resides within the sg_load_player_unit() function, which is responsible for parsing savegame files. An attacker can craft a malicious savegame file containing an invalid unit activity index, which bypasses existing bounds checking logic. Successfully triggering this vulnerability leads to an out-of-bounds memory read, which can result in application crashes (Denial of Service) or the potential disclosure of sensitive heap memory contents. The vulnerability is triggered during the standard savegame loading process, requiring no active network connection or user interaction beyond the user initiating the loading of a compromised file. This flaw poses a moderate risk to systems processing untrusted savegame data, as it allows for memory exposure that could potentially facilitate further exploitation or disrupt service availability.",
  "technicalDetails": "The vulnerability is situated within the sg_load_player_unit() function of the Freeciv source code. This function is tasked with deserializing unit information from game savegame files. The root cause of the flaw is an insufficient validation of the unit activity index field provided within the serialized savegame data. Specifically, the software fails to perform adequate boundary checks on the index before using it to index into an internal array or structure related to unit activities.\nWhen a user loads a malicious savegame file, the sg_load_player_unit() function reads the unit activity index. If an attacker provides a value that is outside the permitted range, the application proceeds to access memory at a location offset from the intended array base. Because the input index is not properly sanitized, the program reads data from adjacent heap memory rather than the expected structure, resulting in an out-of-bounds read condition.\nThe attack flow proceeds as follows: First, the attacker creates a malformed savegame file format recognized by Freeciv. Second, they insert a crafted unit activity index value into the unit data section of the file. Third, when the victim attempts to load this savegame file, the application executes the vulnerable sg_load_player_unit() logic. Finally, the improper bounds checking allows the function to read memory outside of the designated unit activity buffer. The impact depends on the memory layout and the specific data present at the out-of-bounds location. If the read triggers an invalid memory access that violates segment protections, the application will terminate, causing a crash. If the process is successful, the attacker may be able to influence the application's state or cause it to leak sensitive heap information to standard output or error logs, depending on how the application handles the out-of-bounds data in subsequent operations. No authentication or elevated privileges are required to trigger this vulnerability, as the attack is inherently dependent on the file-parsing logic accessible to any user capable of loading a custom savegame."
}