Summaryinfo

A vulnerability categorized as critical has been discovered in longturn freeciv21 up to 3.1.0. This issue affects some unknown processing. Such manipulation leads to stack-based overflow. This vulnerability is listed as CVE-2026-33250. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in longturn freeciv21 up to 3.1.0 and classified as critical. Affected by this issue is an unknown functionality. The manipulation with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is availability. CVE summarizes:

Freeciv21 is a free open source, turn-based, empire-building strategy game. Versions prior to 3.1.1 crash with a stack overflow when receiving specially-crafted packets. A remote attacker can use this to take down any public server. A malicious server can use this to crash the game on the player's machine. Authentication is not needed and, by default, logs do not contain any useful information. All users should upgrade to Freeciv21 version 3.1.1. Running the server behind a firewall can help mitigate the issue for non-public servers. For local games, Freeciv21 restricts connections to the current user and is therefore not affected.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-33250 since 03/18/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. The technical details are unknown and an exploit is not available.

The vulnerability scanner Nessus provides a plugin with the ID 303285 (Linux Distros Unpatched Vulnerability : CVE-2026-33250), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.1.1 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch ad8e18ca22595529599782b2984bf44df8d69ed6 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at CNNVD (CNNVD-202603-4629) and Tenable (303285). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• longturn

Name

• freeciv21

Version

• 3.0
• 3.1.0

License

• open-source

Website

• Product: https://github.com/longturn/freeciv21/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion