2K Games Civilization V Lua Sandbox loadstring type confusion

published 2026-10-26 14 d ago modified 2026-10-29 11 d ago also EUVD-2026-109603

cvss: 6.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 23%
public exploits: 0; none known

A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox. Executing a manipulation can lead to type confusion. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CISA SSVC

Exploitation: Proof of concept is public
Automatable: yes
Technical impact: partial
Assessed: 14 d ago (2026-10-26)

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/drbloop2000/Sid-Meier-s-Civilization-V-RCE/blob/main/exploit.lua referenced PoC, tagged "exploit" by a source, unverified
drbloop.dev https://drbloop.dev/blog/three-click-rce-in-civi-v referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CNA	3.1	6.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
CNA	3.0	6.3	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
CNA	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C
CNA	4.0	2.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	6.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
NVD	3.1	9.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CNA	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

2K Games Civilization V

Classification

Weakness

CWE-843 Access of Resource Using Incompatible Type

References

github.com /drbloop2000/Sid-Meier-s-Civilization-V-RCE/blob/main/exploit.lua
exploit, product
drbloop.dev /blog/three-click-rce-in-civi-v
related, exploit, issue-tracking, third-party-advisory
vuldb.com /vuln/426179
vdb-entry, technical-description, third-party-advisory
vuldb.com /vuln/426179/cti
signature, permissions-required, third-party-advisory, vdb-entry
vuldb.com /cve/CVE-2026-116111
third-party-advisory, vdb-entry
vuldb.com /submit/1004678
third-party-advisory, vdb-entry

Sources

CVE List CVE-2026-116111
NVD CVE-2026-116111

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary