Description
A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox. Executing a manipulation can lead to type confusion. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products
2k: sid meiers civilization v
References6
- drbloop.dev/blog/three-click-rce-in-civi-v ExploitIssue TrackingThird Party Advisory
- github.com/drbloop2000/Sid-Meier-s-Civilization-V-RCE/blob/main… Product
- vuldb.com/cve/CVE-2026-116111 Third Party AdvisoryVDB Entry
- vuldb.com/submit/1004678 Third Party AdvisoryVDB Entry
- vuldb.com/vuln/426179 Third Party AdvisoryVDB Entry
- vuldb.com/vuln/426179/cti Third Party AdvisoryVDB Entry
Metrics
- CVSS 3.1
-
9.6
CRITICAL
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - CVSS 4.0
-
2.1
LOW
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 0% percentile: 23 · as of 8 November 2026
- CWE
- CWE-843
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.