CVE-2026-116111: 2K Games Civilization V Lua Sandbox loadstring type confusion

Severity: critical (CVSS 9.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-10-26 · updated 2026-10-29
Weakness: CWE-843

Description

A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox. Executing a manipulation can lead to type confusion. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Summary

A critical type-confusion flaw exists in the Lua Sandbox's loadstring function in 2K Games Civilization V 1.0.3.144, and it can be triggered remotely. A public exploit has been disclosed, so the risk of attack is real, though EPSS estimates only a 0.2% chance of exploitation in the next 30 days and it is not in CISA KEV. The vendor was contacted but did not respond, so no official patch is known. Mitigate by restricting network exposure, avoiding untrusted Lua content or mods, and monitoring for vendor updates.

توجد ثغرة حرجة من نوع الخلط بين الأنواع (type confusion) في الدالة loadstring ضمن مكوّن Lua Sandbox في 2K Games Civilization V الإصدار 1.0.3.144، ويمكن استغلالها عن بُعد. تم الكشف عن استغلال عام للثغرة، ما يجعل خطر الهجوم حقيقياً، رغم أن تقديرات EPSS تشير إلى احتمال استغلال بنسبة 0.2% خلال 30 يوماً، وهي غير مدرجة في CISA KEV. تم التواصل مع المورّد مسبقاً لكنه لم يرد، لذا لا يُعرف تحديث رسمي. يُنصح بتقييد التعرض للشبكة وتجنب محتوى Lua أو التعديلات غير الموثوقة ومتابعة أي تحديثات من المورّد.

Affected products

2k Sid Meiers Civilization V: 1.0.3.144 (and their updates)
2K Games Civilization V: 1.0.3.144

References

Get alerted when CVE-2026-116111 or the next vulnerability affects your stack