UnratedFix available

DEBIAN-CVE-2026-90556

Type: advisorySource: OSV1 source record

Freeciv versions before 3.2.6 contain a heap buffer overflow in worklist_load() when processing savegame files with declared worklist lengths exceeding the fixed array bound of 64 elements. Attackers can craft malicious savegame files that write past the entries array into adjacent heap-allocated struct fields, potentially corrupting memory when a user or server operator loads the file.

Announced 12 Sept 2026Group revision 1

Original source ↗

DEBIAN-CVE-2026-90556

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-90556

freeciv

Source reference: /affected/0/package/name

Affected versions: 3.0.6-1
Source reference: /affected/0/versions
3.0.6-1+deb12u1
Source reference: /affected/0/versions
3.0.8-1
Source reference: /affected/0/versions
3.0.8-2
Source reference: /affected/0/versions
3.1.0+ds-1
Source reference: /affected/0/versions
3.1.1+ds-1
Source reference: /affected/0/versions
3.1.2+ds-1
Source reference: /affected/0/versions
3.1.2+ds-2
Source reference: /affected/0/versions
3.1.2+ds-2~exp1
Source reference: /affected/0/versions
3.1.4+ds-1
Source reference: /affected/0/versions
3.1.4+ds-2
Source reference: /affected/0/versions
3.2.0+ds-1
Source reference: /affected/0/versions
3.2.1+ds-1
Source reference: /affected/0/versions
3.2.1+ds-2
Source reference: /affected/0/versions
3.2.2+ds-1
Source reference: /affected/0/versions
3.2.4+ds-1
Source reference: /affected/0/versions
3.2.5+ds-1
Source reference: /affected/0/versions
3.2.6+ds-1
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

freeciv

Source reference: /affected/1/package/name

Affected versions: 3.1.4+ds-2
Source reference: /affected/1/versions
3.1.4+ds-2+deb13u1
Source reference: /affected/1/versions
3.2.0+ds-1
Source reference: /affected/1/versions
3.2.1+ds-1
Source reference: /affected/1/versions
3.2.1+ds-2
Source reference: /affected/1/versions
3.2.2+ds-1
Source reference: /affected/1/versions
3.2.4+ds-1
Source reference: /affected/1/versions
3.2.5+ds-1
Source reference: /affected/1/versions
3.2.6+ds-1
Source reference: /affected/1/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

freeciv

Source reference: /affected/2/package/name

Affected versions: 3.1.4+ds-2
Source reference: /affected/2/versions
3.2.0+ds-1
Source reference: /affected/2/versions
3.2.1+ds-1
Source reference: /affected/2/versions
3.2.1+ds-2
Source reference: /affected/2/versions
3.2.2+ds-1
Source reference: /affected/2/versions
3.2.4+ds-1
Source reference: /affected/2/versions
3.2.5+ds-1
Source reference: /affected/2/versions
Fixed versions: 3.2.6+ds-1
Source reference: /affected/2/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "freeciv",
      "purl": "pkg:deb/debian/freeciv?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "3.0.6-1",
      "3.0.6-1+deb12u1",
      "3.0.8-1",
      "3.0.8-2",
      "3.1.0+ds-1",
      "3.1.1+ds-1",
      "3.1.2+ds-1",
      "3.1.2+ds-2",
      "3.1.2+ds-2~exp1",
      "3.1.4+ds-1",
      "3.1.4+ds-2",
      "3.2.0+ds-1",
      "3.2.1+ds-1",
      "3.2.1+ds-2",
      "3.2.2+ds-1",
      "3.2.4+ds-1",
      "3.2.5+ds-1",
      "3.2.6+ds-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-90556.json"
    },
    "ecosystem_specific": {
      "urgency": "end-of-life"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "freeciv",
      "purl": "pkg:deb/debian/freeciv?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "3.1.4+ds-2",
      "3.1.4+ds-2+deb13u1",
      "3.2.0+ds-1",
      "3.2.1+ds-1",
      "3.2.1+ds-2",
      "3.2.2+ds-1",
      "3.2.4+ds-1",
      "3.2.5+ds-1",
      "3.2.6+ds-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-90556.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "3.2.6+ds-1"
          }
        ]
      }
    ],
    "package": {
      "name": "freeciv",
      "purl": "pkg:deb/debian/freeciv?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "3.1.4+ds-2",
      "3.2.0+ds-1",
      "3.2.1+ds-1",
      "3.2.1+ds-2",
      "3.2.2+ds-1",
      "3.2.4+ds-1",
      "3.2.5+ds-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-90556.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #6093 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:21:51 GMT
Publisher date: Sat, 12 Sep 2026 18:16:44 GMT

Read the original announcement

Revision history

24 Oct 2026DEBIAN-CVE-2026-90556 · Revision 1Source updated