The flaw arises from a type confusion bug in the loadstring function of the Lua sandbox used by Sid Meier’s Civilization IV. If an attacker supplies specially crafted data, the function fails to correctly enforce its expected type, potentially allowing execution of arbitrary code within the game’s runtime environment. This weakness is classified as CWE‑843 and, because it involves remotely accessible sandbox functions, presents a window for an attacker to gain control of the game process. The impact is the ability to run malicious code, which could lead to disclosure of personal information, modification of game state, or broader compromise if the game process interacts with other system components.

The vulnerability affects version 1.0.12.68 of 2 K Games Sid Meier’s Civilization IV. No other versions are listed as impacted, but the issue resides in the core Lua sandbox component and thus may exist in other builds that share the same code base.

The CVSS score of 5.3 indicates a moderate severity of exploitation. The EPSS metric is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of widespread exploitation. However, the exploit code has been publicly released, implying that an attacker can construct a payload that triggers the type confusion remotely. The attack vector is inferred to be remote – an attacker could send a malicious file, mod script, or network packet that forces loadstring to misinterpret data. If successful, the attacker may obtain code execution privileges within the game’s sandbox.