---
id: "CVE-2026-116370"
kind: "vulnerability"
aliases: ["CVE-2026-116370"]
title: "Sid Meier's Civilization IV: Lua sandbox type confusion in loadstring"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["civilization-iv", "games", "lua", "other"]
not_affected_if: []
published_at: "2026-10-26T17:17:25+00:00"
first_seen_at: "2026-10-26T17:31:22+00:00"
updated_at: "2026-10-26T17:33:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116370", "first_seen_at": "2026-10-26T17:31:22+00:00"}]
---

# Sid Meier's Civilization IV: Lua sandbox type confusion in loadstring

Sid Meier's Civilization IV 1.0.12.68 has a type confusion flaw in the loadstring function of its Lua sandbox, reported as CVE-2026-116370. The sources say a public exploit exists and the attack may be launched remotely, but they do not say what an attacker gains beyond that.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed game version against `1.0.12.68` (the version the report names)
- unknown for other checks, the sources do not say which files or settings expose the Lua sandbox

## Fix

- unknown, the sources do not name a patched version or vendor fix

## Timeline

- 2026-10-26T17:31:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116370

## From the sources

A security flaw has been discovered in 2K Games Sid Meier's Civilization IV 1.0.12.68. The affected element is the function loadstring of the component Lua sandbox. Performing a manipulation results in type confusion. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_