Vulnerability · Published Oct 26, 2026 · Assigned by VulDB
CVE-2026-1161112K Games Civilization V Lua Sandbox loadstring type confusion
Medium 6.3
In plain English
A medium-severity type confusion in Civilization V from 2K Games. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Official description
A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox. Executing a manipulation can lead to type confusion. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| 2K Games | Civilization V | 1.0.3.144 |
Weakness: CWE-843 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
References
- VDB-426179 | 2K Games Civilization V Lua Sandbox loadstring type confusion vdb-entry, technical-description
- VDB-426179 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- CVE-2026-116111 | CVE Analysis and Report third-party-advisory
- Submit #1004678 | 2K Games Civilization V 1.0.3.144 Exposed Dangerous Method or Function third-party-advisory
- https://drbloop.dev/blog/three-click-rce-in-civi-v related
- https://github.com/drbloop2000/Sid-Meier-s-Civilization-V-RCE/blob/main/exploit.lua exploit