CVE-2026-116111
Critical
10.0 CVSS v3.1
CVSS v4.0: 2.1
- Published
- Oct 26, 2026
- Updated
- Oct 28, 2026
- Vendor
- 2k
- Affected versions
- See affected products
- Weakness
- CWE-843
Summary
A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox. Executing a manipulation can lead to type confusion. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
Critical (10.0)CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0 (2.1)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Affected products
- 2k Sid Meiers Civilization V 1.0.3.144
Exploitation status
Unknown
Technical details
Technical analysis has not been written for this record yet.
Mitigation & remediation
Follow the vendor advisory linked below for patches and workarounds.