CVE-2026-116230
Received
Received - Intake
Deserialization Flaw in Plague Inc Evolved
Vulnerability report for CVE-2026-116230, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-26
Last updated on: 2026-10-26
Assigner: VulDB
Description
Description
A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to 1.24.0.3. The affected element is an unknown function of the component Workshop Scenario Loader. Such manipulation leads to deserialization. The attack may be performed from remote. Upgrading to version 1.24.0.4 is sufficient to fix this issue. It is recommended to upgrade the affected component.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Ndemic Creations | Plague Inc Evolved | 1.24.0.0 |
| Ndemic Creations | Plague Inc Evolved | 1.24.0.1 |
| Ndemic Creations | Plague Inc Evolved | 1.24.0.2 |
| Ndemic Creations | Plague Inc Evolved | 1.24.0.3 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
