---
id: "CVE-2026-116111"
kind: "vulnerability"
aliases: ["CVE-2026-116111"]
title: "Civilization V: Lua sandbox loadstring flaw allows type confusion remotely"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Civilization V", "fixed": [], "affected": "1.0.3.144", "ecosystem": "vendor"}]
ecosystems: []
tags: ["civilization-v", "game-client", "lua", "mods", "package", "sandbox-escape", "user-interaction"]
not_affected_if: ["no-third-party-mods", "other-version"]
published_at: "2026-10-26T03:17:11+00:00"
first_seen_at: "2026-10-26T03:39:26+00:00"
updated_at: "2026-10-26T03:40:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116111", "first_seen_at": "2026-10-26T03:39:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-26T03:40:48+00:00"}]
---

# Civilization V: Lua sandbox loadstring flaw allows type confusion remotely

Civilization V 1.0.3.144 has a Lua sandbox weakness reported by an independent researcher; the vendor (2K) did not respond and no patch is known. NVD calls it type confusion in loadstring; VulDB calls it a sandbox escape via os.execute. A public PoC reportedly exists. Attack needs user interaction, probably loading a malicious mod or content.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Civilization V affected 1.0.3.144 fixed ?

## How to check

Check the game version (main menu or Steam properties); 1.0.3.144 is the reported affected build. Review installed mods in the game's MODS folder and Steam Workshop subscriptions for ones you don't trust.

## Fix

unknown: no patched version or vendor response. Until then, avoid untrusted mods/Workshop content.

## Timeline

- 2026-10-26T03:39:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116111
- 2026-10-26T03:40:48+00:00 analyst — No vendor advisory; vendor silent per VulDB. VulDB VDB-426179 (linked) describes the flaw as Lua sandbox escape via os.execute (CWE-265), PoC on GitHub, researcher advisory at drbloop.dev (not fetched, link not given). NVD text says loadstring type confusion; the two descriptions conflict. Needs user interaction (VulDB), so not pre-auth remote.

## Documents

- [describes] VulDB VDB-426179: Civilization V 1.0.3.144 Lua Sandbox (CVE-2026-116111) https://vuldb.com/vuln/426179
- [mentions] Civ5 Lua implementation (Lua 5.1.4, modified for sandboxing) https://modiki.civfanatics.com/index.php/Specificities_of_the_Lua_implementation_in_Civ5

## From the sources

A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox. Executing a manipulation can lead to type confusion. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_