{"id":"CVE-2026-116230","kind":"vulnerability","aliases":["CVE-2026-116230"],"related":[],"title":"Plague Inc Evolved: Workshop scenario loader deserialization flaw enables remote attack","description":"A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to 1.24.0.3. The affected element is an unknown function of the component Workshop Scenario Loader. Such manipulation leads to deserialization. The attack may be performed from remote. Upgrading to version 1.24.0.4 is sufficient to fix this issue. It is recommended to upgrade the affected component.","summary":"Plague Inc Evolved up to 1.24.0.3 has a deserialization flaw in its Workshop Scenario Loader component. A remote attacker can trigger it, and the sources do not say what code execution or data access results.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","games","ios","other","plague-inc-evolved","windows"],"not_affected_if":["version-1.24.0.4-or-later"],"how_to_check":"- Check the installed Plague Inc Evolved version on each device or install (the game client, not a server); flagged builds are up to `1.24.0.3`\n- unknown for any other check, the sources do not say","fix":"- Update Plague Inc Evolved to `1.24.0.4` or later, as the description recommends","status":"open","published_at":"2026-10-26T08:17:17+00:00","first_seen_at":"2026-10-26T08:28:59+00:00","triaged_at":"2026-10-26T08:30:20+00:00","updated_at":"2026-10-26T08:30:20+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-26T08:30:20Z","model":"claude-haiku-5-5","output":{"fix":"- Update Plague Inc Evolved to `1.24.0.4` or later, as the description recommends","reach":"internet","title":"Plague Inc Evolved: Workshop scenario loader deserialization flaw enables remote attack","impact":"medium","summary":"Plague Inc Evolved up to 1.24.0.3 has a deserialization flaw in its Workshop Scenario Loader component. A remote attacker can trigger it, and the sources do not say what code execution or data access results.","category":"other","nicknames":[],"who_cares":["plague-inc-evolved","games","windows","android","ios"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; sources only say deserialization is triggered remotely","analyst_note":"Check the NVD entry and the vendor advisory for the actual impact (code execution or data only) and whether a Workshop scenario file is the trigger.","how_to_check":"- Check the installed Plague Inc Evolved version on each device or install (the game client, not a server); flagged builds are up to `1.24.0.3`\n- unknown for any other check, the sources do not say","needs_analyst":true,"not_affected_if":["version-1.24.0.4-or-later"],"who_is_affected":"Players and devices running Plague Inc Evolved up to version 1.24.0.3 are affected. The sources do not say whether the attack needs a downloaded Workshop scenario or only a network connection. Teams that do not run the game can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000606,"input_tokens":3349,"output_tokens":543,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116230':14A,17A '-2026':13A,16A '1.24.0.3':32B,74C '1.24.0.4':103C 'access':60B 'affect':76C,116C 'android':18B 'attack':11A,45B,94C 'code':56B 'compon':42B,84C,117C 'creation':68C 'cve':12A,15A 'data':59B 'deseri':7A,35B,92C 'element':77C 'enabl':9A 'evolv':3A,25B,29B,71C 'execut':57B 'fix':107C 'flaw':8A,36B 'function':81C 'game':19B 'identifi':65C 'inc':2A,24B,28B,70C 'io':20B 'issu':109C 'lead':90C 'loader':6A,41B,87C 'manipul':89C 'may':95C 'ndemic':67C 'perform':97C 'plagu':1A,23B,27B,69C 'plague-inc-evolv':22B 'recommend':112C 'remot':10A,44B,99C 'result':61B 'say':54B 'scenario':5A,40B,86C 'sourc':51B 'suffici':105C 'trigger':47B 'unknown':80C 'upgrad':100C,114C 'version':102C 'vulner':63C 'window':26B 'workshop':4A,39B,85C","nicknames":[],"mitigations":[],"who_affected":"Players and devices running Plague Inc Evolved up to version 1.24.0.3 are affected. The sources do not say whether the attack needs a downloaded Workshop scenario or only a network connection. Teams that do not run the game can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T08:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116230","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116230","severity":null,"published_at":"2026-10-26T08:17:17+00:00","modified_at":"2026-10-26T08:17:17+00:00","first_seen_at":"2026-10-26T08:28:59+00:00","fetched_at":"2026-10-26T08:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}