Description
Freeciv21 is a free open source, turn-based, empire-building strategy game. Versions prior to 3.1.1 crash with a stack overflow when receiving specially-crafted packets. A remote attacker can use this to take down any public server. A malicious server can use this to crash the game on the player's machine. Authentication is not needed and, by default, logs do not contain any useful information. All users should upgrade to Freeciv21 version 3.1.1. Running the server behind a firewall can help mitigate the issue for non-public servers. For local games, Freeciv21 restricts connections to the current user and is therefore not affected.
Published: 2026-03-23
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

A stack overflow occurs when Freeciv21 processes specially‑crafted packets before version 3.1.1, causing the server or client to crash. An attacker can trigger this from any networked connection without authentication, leading to abrupt termination of the game or server. The vulnerability is classified as a buffer overread/call stack corruption.

Affected Systems

The issue affects the Freeciv21 open‑source turn‑based strategy game, specifically any installation using a version earlier than 3.1.1. Public servers running this software are vulnerable; servers running only locally or restricted to the current user are not impacted.

Risk and Exploitability

The CVSS score of 7.5 signifies high severity, while no EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. Because the flaw can be triggered remotely without authentication and relies on network packet manipulation, the likelihood of exploitation remains significant, especially for publicly exposed gaming servers.

Generated by OpenCVE AI on March 24, 2026 at 03:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Freeciv21 to version 3.1.1 or later.
  • Configure a firewall to restrict access to the server if it is not intended to be publicly available.
  • Verify that client installations are also at or above v3.1.1 to prevent crashes from malicious servers.
  • Check log files to confirm no additional information is recorded post‑patch.

Generated by OpenCVE AI on March 24, 2026 at 03:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6173-1 freeciv security update
History

Tue, 24 Mar 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 24 Mar 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Longturn
Longturn freeciv21
Vendors & Products Longturn
Longturn freeciv21

Tue, 24 Mar 2026 02:30:00 +0000

Type Values Removed Values Added
Description Freeciv21 is a free open source, turn-based, empire-building strategy game. Versions prior to 3.1.1 crash with a stack overflow when receiving specially-crafted packets. A remote attacker can use this to take down any public server. A malicious server can use this to crash the game on the player's machine. Authentication is not needed and, by default, logs do not contain any useful information. All users should upgrade to Freeciv21 version 3.1.1. Running the server behind a firewall can help mitigate the issue for non-public servers. For local games, Freeciv21 restricts connections to the current user and is therefore not affected.
Title Crash when receiving specially-crafted packets
Weaknesses CWE-121
CWE-20
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Longturn Freeciv21
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-03-24T13:36:23.980Z

Reserved: 2026-03-18T02:42:27.509Z

Link: CVE-2026-33250

cve-icon Vulnrichment

Updated: 2026-03-24T13:36:18.996Z

cve-icon NVD

Status : Deferred

Published: 2026-03-24T00:16:29.830

Modified: 2026-04-15T15:47:31.327

Link: CVE-2026-33250

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-25T20:35:57Z

Weaknesses