CVE-2026-90557: Freeciv

Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days.

Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vulnerability in sg_load_player_unit() when processing savegame files with invalid unit activity indices. An attacker can craft a malicious savegame file with an out-of-range activity index that bypasses bounds checking and causes a crash or limited heap memory exposure when loaded.

Affected products

• Freeciv Freeciv: from 3.1.0, before 3.2.6 (fixed in 3.2.6)

Published 2026-09-12. Last modified 2026-09-23.