CVE-2026-90557
Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vulnerability in sg_load_player_unit() when processing savegame files wit
CVSS
6.1
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Sep 12, 2026 · Last modified: Sep 12, 2026 · CWE-125
Not enough EPSS history yet.
Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vulnerability in sg_load_player_unit() when processing savegame files with invalid unit activity indices. An attacker can craft a malicious savegame file with an out-of-range activity index that bypasses bounds checking and causes a crash or limited heap memory exposure when loaded.
- github.comhttps://github.com/freeciv/freeciv
- github.comhttps://github.com/freeciv/freeciv/blob/R3_2_5/server/savegame/savegame2.c#L4282
- github.comhttps://github.com/freeciv/freeciv/blob/R3_2_5/server/savegame/savegame3.c#L6108
- github.comhttps://github.com/freeciv/freeciv/commit/ef0c76c2765fe383140eb1a70dbea1228844152e
- github.comhttps://github.com/freeciv/freeciv/releases/tag/R3_2_6
- redmine.freeciv.orghttps://redmine.freeciv.org/issues/2162
- www.vulncheck.comhttps://www.vulncheck.com/advisories/freeciv-3.1.0-through-3.2.5-out-of-bounds-read-via-savegame
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-905608.2 HIG—
———zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or length values to read memory past the end of the supplied array, potentially causing JVM termination.2hCVE-2026-78546——
——0Out-of-bounds read vulnerability in Citirx Workspace app for Windows.
This issue affects Workspace app for Windows: before 2603.11 Current Release (CR), before 2507.1 LTSR CU3, and before LTSR 2607.1dCVE-2026-13326—4.7%
——1An out-of-bounds read in Qt NFC's language code length parsing allows a physically proximate attacker to cause a denial of service or limited memory disclosure via a crafted NFC tag.1dCVE-2026-891603.7 LOW12.6%
——4PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.1dCVE-2026-891562.9 LOW1.0%
——0PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.1dCVE-2026-16172—1.7%
——1Netskope was notified of an out-of-bounds heap read affecting the Endpoint DLP (EPDLP) service of the Netskope Client. A local standard user could potentially send a specially crafted message that is not properly validated with a bounds check, likely crashing the kernel driver handler. Successful exploitation could potentially crash the EPDLP service, temporarily interrupting DLP enforcement. A successful exploit could potentially also reveal per-boot memory layout information to unauthorized users.1d