CVE-2026-90557

Name of the Vulnerable Software and Affected Versions Freeciv versions 3.1.0 through 3.2.5

Description An out-of-bounds read occurs in the sg load player unit() function when processing savegame files containing invalid unit activity indices. A malicious savegame file with an out-of-range activity index can bypass bounds checking, leading to a crash or limited heap memory exposure during the loading process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.