{"id":"CVE-2026-116370","kind":"vulnerability","aliases":["CVE-2026-116370"],"related":[],"title":"Sid Meier's Civilization IV: Lua sandbox type confusion in loadstring","description":"A security flaw has been discovered in 2K Games Sid Meier's Civilization IV 1.0.12.68. The affected element is the function loadstring of the component Lua sandbox. Performing a manipulation results in type confusion. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.","summary":"Sid Meier's Civilization IV 1.0.12.68 has a type confusion flaw in the loadstring function of its Lua sandbox, reported as CVE-2026-116370. The sources say a public exploit exists and the attack may be launched remotely, but they do not say what an attacker gains beyond that.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["civilization-iv","games","lua","other"],"not_affected_if":[],"how_to_check":"- Check the installed game version against `1.0.12.68` (the version the report names)\n- unknown for other checks, the sources do not say which files or settings expose the Lua sandbox","fix":"- unknown, the sources do not name a patched version or vendor fix","status":"open","published_at":"2026-10-26T17:17:25+00:00","first_seen_at":"2026-10-26T17:31:22+00:00","triaged_at":"2026-10-26T17:33:06+00:00","updated_at":"2026-10-26T17:33:06+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-26T17:33:06Z","model":"claude-haiku-5-5","output":{"fix":"- unknown, the sources do not name a patched version or vendor fix","reach":"internet","title":"Sid Meier's Civilization IV: Lua sandbox type confusion in loadstring","impact":"medium","summary":"Sid Meier's Civilization IV 1.0.12.68 has a type confusion flaw in the loadstring function of its Lua sandbox, reported as CVE-2026-116370. The sources say a public exploit exists and the attack may be launched remotely, but they do not say what an attacker gains beyond that.","category":"other","nicknames":[],"who_cares":["civilization-iv","games","lua"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown, the sources do not state the impact beyond type confusion","analyst_note":"Find the vendor advisory or exploit write-up for CVE-2026-116370 to confirm the impact, the trigger (mod script or remote), and any patch; start from the NVD entry linked in the sources.","how_to_check":"- Check the installed game version against `1.0.12.68` (the version the report names)\n- unknown for other checks, the sources do not say which files or settings expose the Lua sandbox","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown. The sources name only the game version 1.0.12.68 and the Lua sandbox loadstring function. They do not say which mods, network paths or configurations reach it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000597,"input_tokens":3338,"output_tokens":526,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116370':14A,17A,46B '-2026':13A,16A,45B '1.0.12.68':28B,85C '2k':78C 'affect':87C 'attack':56B,68B,106C,124C 'beyond':70B 'civil':4A,19B,26B,83C 'civilization-iv':18B 'compon':95C 'confus':9A,32B,104C 'contact':128C 'cve':12A,15A,44B 'disclosur':132C 'discov':76C 'earli':129C 'element':88C 'exist':53B 'exploit':52B,112C 'flaw':33B,73C 'function':37B,91C 'gain':69B 'game':21B,79C 'initi':109C 'iv':5A,20B,27B,84C 'launch':59B 'loadstr':11A,36B,92C 'lua':6A,22B,40B,96C 'manipul':100C 'may':57B,107C,120C 'meier':2A,24B,81C 'perform':98C 'public':51B,118C 'releas':115C 'remot':60B,110C 'report':42B 'result':101C 'sandbox':7A,41B,97C 'say':49B,65B 'secur':72C 'sid':1A,23B,80C 'sourc':48B 'type':8A,31B,103C 'use':122C 'vendor':126C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T17:17:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116370","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116370","severity":null,"published_at":"2026-10-26T17:17:25+00:00","modified_at":"2026-10-26T17:17:25+00:00","first_seen_at":"2026-10-26T17:31:22+00:00","fetched_at":"2026-10-26T17:31:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}