CVE-2026-116111
Received Received - Intake

Type Confusion in 2K Games Civilization V Lua Sandbox

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulDB

Description
A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox. Executing a manipulation can lead to type confusion. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116111
EUVD
EUVD-2026-109603

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
2K Games Civilization V 1.0.3.144

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-843 The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a type confusion flaw in the loadstring function of the Lua Sandbox component in 2K Games Civilization V version 1.0.3.144. It allows attackers to manipulate data types in a way that could lead to remote code execution. The issue arises from improper handling of certain inputs, enabling an attacker to craft malicious payloads that bypass security checks.

Detection Guidance

Detecting this vulnerability requires checking for unusual Lua script execution or bytecode manipulation in Civilization V. Monitor game logs for unexpected command executions or crashes. Use process monitoring tools like Process Explorer or Wireshark to inspect network traffic for suspicious Lua payloads.

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute arbitrary commands on your system through the game's Lua environment. This means they could run programs, access files, or perform other malicious actions without your knowledge. The attack can be initiated remotely, even without direct access to your machine.

Compliance Impact

This vulnerability allows remote code execution in Civilization V via a Lua sandbox type confusion flaw. It could enable unauthorized access to game systems, potentially leading to data exfiltration or manipulation. For GDPR, this may impact data integrity and confidentiality requirements. For HIPAA, it could compromise protected health information if game data interacts with medical systems. However, direct compliance impact depends on system context and data processing activities.

Mitigation Strategies

Immediately update Civilization V to the latest version if available. Disable Lua scripting in the game settings if possible. Restrict network access to the game and monitor for unauthorized command executions. Consider blocking the game's executable via firewall rules until a patch is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116111. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart