Description
A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox. Executing a manipulation can lead to type confusion. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-10-26
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Remote code execution via type confusion in the Lua Sandbox
Action: Assess Impact
AI Analysis

Impact

A type confusion flaw exists in the loadstring function of the Lua Sandbox component in 2K Games Civilization V. The vulnerability can be triggered by manipulating the input to loadstring, potentially allowing an attacker to execute arbitrary code on the target system. This type of flaw may compromise confidentiality, integrity, or availability by enabling malicious code execution once the sandbox is breached.

Affected Systems

The affected product is 2K Games Civilization V, specifically version 1.0.3.144. No other versions are listed as impacted in the available data.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. Exploitation may be performed remotely, and the vulnerability has been publicly disclosed, potentially making it accessible to attackers. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, suggesting that while the risk is not currently highly prioritized, it remains a valid threat and may be exploited by adversaries with the required skills.

Generated by OpenCVE AI on October 26, 2026 at 04:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Civilization V to the latest available version that includes a fix for the loadstring type confusion flaw.
  • If a patch is not available, temporarily disable or restrict Lua scripting features in the game settings to prevent exploitation of the loadstring function.
  • Verify that any third‑party mods or user‑generated scripts are sourced from trusted parties and do not contain malicious code that could abuse loadstring.

Generated by OpenCVE AI on October 26, 2026 at 04:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 03:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox. Executing a manipulation can lead to type confusion. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Title 2K Games Civilization V Lua Sandbox loadstring type confusion
First Time appeared 2k Games
2k Games civilization V
Weaknesses CWE-843
CPEs cpe:2.3:a:2k_games:civilization_v:*:*:*:*:*:*:*:*
Vendors & Products 2k Games
2k Games civilization V
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

2k Games Civilization V
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-26T02:45:21.294Z

Reserved: 2026-10-25T08:32:44.250Z

Link: CVE-2026-116111

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-26T03:17:11.603

Modified: 2026-10-26T03:17:11.603

Link: CVE-2026-116111

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T04:30:08Z

Weaknesses
  • CWE-843

    Access of Resource Using Incompatible Type ('Type Confusion')