Live › vulnerability › CVE-2026-116111
Go to dashboardCivilization V 1.0.3.144 has a Lua sandbox weakness reported by an independent researcher; the vendor (2K) did not respond and no patch is known. NVD calls it type confusion in loadstring; VulDB calls it a sandbox escape via os.execute. A public PoC reportedly exists. Attack needs user interaction, probably loading a malicious mod or content.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 03:39 UTC. All times on this page are UTC.
Anyone running Civilization V 1.0.3.144 who loads untrusted mods, Workshop content or scenarios, since those run Lua in the sandbox. Whether multiplayer is a route is not stated in any source. Players who only run first-party content can mostly skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Civilization V | vendor | 1.0.3.144 | – |
1.0.3.144 is the reported affected builds MODS folder and Steam Workshop subscriptions for ones you dont trustEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox. Executing a manipulation can lead to type confusion. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-116111")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.