CVE-2026-116111
2K Games Civilization V Lua Sandbox loadstring type confusion
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox. Executing a manipulation can lead to type confusion. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
| CWE | CWE-843 |
| Vendor | 2k games |
| Product | civilization v |
| Published | Oct 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for 2k games civilization v
Be the first to know when new medium vulnerabilities affecting 2k games civilization v are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
2K Games / Civilization V
1.0.3.144
References
vuldb.com: https://vuldb.com/vuln/426179 vuldb.com: https://vuldb.com/vuln/426179/cti vuldb.com: https://vuldb.com/cve/CVE-2026-116111 vuldb.com: https://vuldb.com/submit/1004678 drbloop.dev: https://drbloop.dev/blog/three-click-rce-in-civi-v github.com: https://github.com/drbloop2000/Sid-Meier-s-Civilization-V-RCE/blob/main/exploit.lua
Credits
VulDB CNA Team