{"id":"CVE-2026-116111","kind":"vulnerability","aliases":["CVE-2026-116111"],"related":[],"title":"Civilization V: Lua sandbox loadstring flaw allows type confusion remotely","description":"A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox. Executing a manipulation can lead to type confusion. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Civilization V 1.0.3.144 has a Lua sandbox weakness reported by an independent researcher; the vendor (2K) did not respond and no patch is known. NVD calls it type confusion in loadstring; VulDB calls it a sandbox escape via os.execute. A public PoC reportedly exists. Attack needs user interaction, probably loading a malicious mod or content.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Civilization V","fixed":[],"affected":"1.0.3.144","ecosystem":"vendor"}],"ecosystems":[],"tags":["civilization-v","game-client","lua","mods","package","sandbox-escape","user-interaction"],"not_affected_if":["no-third-party-mods","other-version"],"how_to_check":"Check the game version (main menu or Steam properties); 1.0.3.144 is the reported affected build. Review installed mods in the game's MODS folder and Steam Workshop subscriptions for ones you don't trust.","fix":"unknown: no patched version or vendor response. Until then, avoid untrusted mods/Workshop content.","status":"open","published_at":"2026-10-26T03:17:11+00:00","first_seen_at":"2026-10-26T03:39:26+00:00","triaged_at":"2026-10-26T03:40:00+00:00","updated_at":"2026-10-26T03:40:48+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-26T03:40:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Civilization V: Lua sandbox loadstring flaw allows type confusion remotely","impact":"high","summary":"Civilization V version 1.0.3.144 has a type confusion flaw in the loadstring function of its Lua sandbox. A remote attacker can trigger it by manipulating input, and the exploit has been publicly disclosed.","category":"package","nicknames":[],"who_cares":["civilization-v","game-client","lua"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown code execution or memory corruption from crafted Lua input","analyst_note":"Confirm the exposed input path, whether mods or multiplayer trigger loadstring, and whether a patch exists; the NVD link is the only source given.","how_to_check":"- Check the installed game version in the game's About or version screen, or in the game's install files; unknown if the sources give a file path.\n- Look for `1.0.3.144` as the installed version.","needs_analyst":true,"not_affected_if":["other-version"],"who_is_affected":"Players and hosts running Civilization V build 1.0.3.144 are named in the advisory. The sources do not say whether multiplayer or mod-loading paths are the exposed route, and they do not name a patched version. The vendor did not respond to the disclosure.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00058,"input_tokens":3331,"output_tokens":494,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the exposed input path, whether mods or multiplayer trigger loadstring, and whether a patch exists; the NVD link is the only source given.","search":"'-116111':13A,16A '-2026':12A,15A '1.0.3.144':36B,98C '2k':49B,94C 'allow':7A 'attack':78B,118C 'call':59B,66B 'civil':1A,20B,34B,96C 'civilization':17A 'civilization-v':19B 'client':24B 'compon':106C 'confus':9A,62B,116C 'contact':137C 'content':88B 'cve':11A,14A 'determin':92C 'disclos':129C 'disclosur':141C 'earli':138C 'escap':30B,70B 'execut':109C 'exist':77B 'exploit':125C 'flaw':6A 'function':102C 'game':23B,95C 'game-cli':22B 'impact':99C 'independ':45B 'interact':33B,81B 'known':57B 'lead':113C 'load':83B 'loadstr':5A,64B,103C 'lua':3A,25B,39B,107C 'malici':85B 'manipul':111C 'may':119C,131C 'mod':26B,86B 'need':79B 'nvd':58B 'os.execute':72B 'packag':27B 'patch':55B 'perform':121C 'poc':75B 'probabl':82B 'public':74B,128C 'remot':10A,123C 'report':42B,76B 'research':46B 'respond':52B,145C 'sandbox':4A,29B,40B,69B,108C 'sandbox-escap':28B 'type':8A,61B,115C 'user':32B,80B 'user-interact':31B 'util':133C 'v':2A,18A,21B,35B,97C 'vendor':48B,135C 'via':71B 'vuldb':65B 'vulner':90C 'way':148C 'weak':41B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Civilization V 1.0.3.144 who loads untrusted mods, Workshop content or scenarios, since those run Lua in the sandbox. Whether multiplayer is a route is not stated in any source. Players who only run first-party content can mostly skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T03:17:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116111","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116111","severity":null,"published_at":"2026-10-26T03:17:11+00:00","modified_at":"2026-10-26T03:17:11+00:00","first_seen_at":"2026-10-26T03:39:26+00:00","fetched_at":"2026-10-26T03:39:26+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116111:827","url":null,"severity":null,"published_at":"2026-10-26T03:40:48+00:00","modified_at":"2026-10-26T03:40:48+00:00","first_seen_at":"2026-10-26T03:40:48+00:00","fetched_at":"2026-10-26T03:40:48+00:00","note":"No vendor advisory; vendor silent per VulDB. VulDB VDB-426179 (linked) describes the flaw as Lua sandbox escape via os.execute (CWE-265), PoC on GitHub, researcher advisory at drbloop.dev (not fetched, link not given). NVD text says loadstring type confusion; the two descriptions conflict. Needs user interaction (VulDB), so not pre-auth remote."}],"documents":[{"id":3705,"url":"https://vuldb.com/vuln/426179","title":"VulDB VDB-426179: Civilization V 1.0.3.144 Lua Sandbox (CVE-2026-116111)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":3707,"url":"https://modiki.civfanatics.com/index.php/Specificities_of_the_Lua_implementation_in_Civ5","title":"Civ5 Lua implementation (Lua 5.1.4, modified for sandboxing)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}