CVE-2026-116370EUVD-2026-109977GHSA-X6V8-MWJF-8MRC
2K Games Sid Meier's Civilization VI Lua sandbox loadstring type confusion
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
Summary
Sid Meier's Civilization IV by 2K Games has a flaw in the `loadstring` function of its Lua sandbox that can be triggered remotely and leads to type confusion. This could let an attacker cause unintended behavior and undermine the sandbox's protections.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A security flaw has been discovered in 2K Games Sid Meier's Civilization VI 1.0.12.68. The affected element is the function loadstring of the component Lua sandbox. Performing a manipulation results in type confusion. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.
Timeline
- CVE published
- First seen by cve.now
- Record last updated
Affected versions
- 2K Games Sid Meier's Civilization VI
1.0.12.68