CVE-2026-116370: 2K Games Sid Meier's Civilization VI Lua sandbox loadstring type confusion

Severity: critical (CVSS 9.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-10-26 · updated 2026-10-29
Weakness: CWE-843

Description

A security flaw has been discovered in 2K Games Sid Meier's Civilization VI 1.0.12.68. The affected element is the function loadstring of the component Lua sandbox. Performing a manipulation results in type confusion. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.

Summary

A type confusion flaw exists in the Lua sandbox's loadstring function in 2K Games Sid Meier's Civilization VI 1.0.12.68, rated critical (CVSS 10). It can be triggered remotely, and a public exploit has been released, though the vendor was contacted before disclosure. The flaw is not in CISA KEV and EPSS estimates a 0.3% chance of exploitation in 30 days. Apply the vendor's fix or mitigation for the affected version; no patched version number is available in this advisory.

توجد ثغرة ارتباك في النوع (type confusion) في دالة loadstring ضمن بيئة Lua sandbox في لعبة 2K Games Sid Meier's Civilization VI الإصدار 1.0.12.68، وتصنيفها حرج (CVSS 10). يمكن استغلالها عن بُعد، وقد نُشر استغلال عام لها، مع العلم أنه تم التواصل مع المورّد قبل الإفصاح. الثغرة غير مدرجة في CISA KEV، وتقدّر EPSS احتمال الاستغلال خلال 30 يوماً بنسبة 0.3%. طبّق إصلاح المورّد أو التخفيف الخاص بالإصدار المتأثر؛ لا يتوفر رقم إصدار مُصحّح في هذا التنبيه.

Affected products

2k Sid Meiers Civilization Vi: 1.0.12.68 (and their updates)
2K Games Sid Meier's Civilization VI: 1.0.12.68

References

Get alerted when CVE-2026-116370 or the next vulnerability affects your stack