« Volver al listado

CVE-2026-33250

Estado: AplazadaAlta (7.5)—

Freeciv21 is a free open source, turn-based, empire-building strategy game. Versions prior to 3.1.1 crash with a stack overflow when receiving specially-crafted packets. A remote attacker can use this to take down any public server. A malicious server can use this to crash the game on the player's machine. Authentication is not needed and, by default, logs do not contain any useful information. All users should upgrade to Freeciv21 version 3.1.1. Running the server behind a firewall can help mitigate the issue for non-public servers. For local games, Freeciv21 restricts connections to the current user and is therefore not affected.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector CVSS con AV:N/PR:N/UI:N permite explotación remota sin autenticación (T1190). Stack overflow causa crash de servidor/cliente, resultando en DoS (T1499.004).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Freeciv21 — Freeciv21AI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-33250",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-33250",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-24T13:36:15.835264Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "longturn",
          "product": "freeciv21",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.1.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-24T00:16:29.830",
  "references": [
    {
      "url": "https://github.com/longturn/freeciv21/commit/ad8e18ca22595529599782b2984bf44df8d69ed6",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/longturn/freeciv21/releases/tag/v3.1.1",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/longturn/freeciv21/security/advisories/GHSA-f76g-6w3f-f6r3",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://redmine.freeciv.org/issues/1955",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-121"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Freeciv21 is a free open source, turn-based, empire-building strategy game. Versions prior to 3.1.1 crash with a stack overflow when receiving specially-crafted packets. A remote attacker can use this to take down any public server. A malicious server can use this to crash the game on the player's machine. Authentication is not needed and, by default, logs do not contain any useful information. All users should upgrade to Freeciv21 version 3.1.1. Running the server behind a firewall can help mitigate the issue for non-public servers. For local games, Freeciv21 restricts connections to the current user and is therefore not affected."
    },
    {
      "lang": "es",
      "value": "Freeciv21 es un juego de estrategia gratuito de código abierto, por turnos, de construcción de imperios. Las versiones anteriores a la 3.1.1 fallan con un desbordamiento de pila al recibir paquetes especialmente diseñados. Un atacante remoto puede usar esto para derribar cualquier servidor público. Un servidor malicioso puede usar esto para bloquear el juego en la máquina del jugador. No se necesita autenticación y, por defecto, los registros no contienen ninguna información útil. Todos los usuarios deberían actualizar a la versión 3.1.1 de Freeciv21. Ejecutar el servidor detrás de un cortafuegos puede ayudar a mitigar el problema para servidores no públicos. Para juegos locales, Freeciv21 restringe las conexiones al usuario actual y por lo tanto no se ve afectado."
    }
  ],
  "lastModified": "2026-06-17T10:37:11.590",
  "sourceIdentifier": "security-advisories@github.com"
}