Skip to content
OpenAdvisories
High · 7.5 CVE-2026-33250 EUVD-2026-14642

Crash when receiving specially-crafted packets

Published Mar 23, 2026 · Updated Mar 24, 2026 · Assigned by GitHub_M

Description

Freeciv21 is a free open source, turn-based, empire-building strategy game. Versions prior to 3.1.1 crash with a stack overflow when receiving specially-crafted packets. A remote attacker can use this to take down any public server. A malicious server can use this to crash the game on the player's machine. Authentication is not needed and, by default, logs do not contain any useful information. All users should upgrade to Freeciv21 version 3.1.1. Running the server behind a firewall can help mitigate the issue for non-public servers. For local games, Freeciv21 restricts connections to the current user and is therefore not affected.

Affected products

VendorProductAffectedFixed
longturn freeciv21 < 3.1.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 freeciv 3.2.4+ds-1 —
Debian 13 freeciv 3.1.4+ds-2+deb13u1 DSA-6173-1
Debian 12 freeciv 3.0.6-1+deb12u1 DSA-6173-1
ReleasePackageFixed inAdvisory
Ubuntu 25.10 freeciv No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS freeciv 3.1.0+ds-1ubuntu0.1~esm1 USN-8754-1
Ubuntu Pro 22.04 LTS freeciv 2.6.6-1ubuntu0.1~esm1 USN-8754-1
Ubuntu Pro 20.04 LTS freeciv 2.6.2-1ubuntu0.1~esm1 USN-8754-1
Ubuntu Pro 18.04 LTS freeciv 2.5.10-1ubuntu0.1~esm1 USN-8754-1
Ubuntu Pro 16.04 LTS freeciv 2.5.3-1ubuntu0.1~esm1 USN-8754-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed freeciv 3.2.4-1.1 openSUSE-SU-2026:10401-1
openSUSE Leap 16.0 freeciv 3.2.4-bp160.1.1 openSUSE-SU-2026:20423-1

Advisories 4

References