Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for Sid Meier's Civilization VI by 2K Games

    CVE-2026-116370 (GCVE-0-2026-116370)

    Vulnerability from nvd – Published: 2026-10-26 16:15 – Updated: 2026-10-27 05:47
    VLAI
    Title
    2K Games Sid Meier's Civilization VI Lua sandbox loadstring type confusion
    Summary
    A security flaw has been discovered in 2K Games Sid Meier's Civilization VI 1.0.12.68. The affected element is the function loadstring of the component Lua sandbox. Performing a manipulation results in type confusion. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.
    Severity
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
    6.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
    6.3 (Medium)
    CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
    CWE
    Assigner
    VulDB CNA under the mitre root
    CNA scorecard B 83/100 over 3873 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    2K Games Sid Meier's Civilization VI Affected: 1.0.12.68
        cpe:2.3:a:2k_games:sid_meiers_civilization_vi:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    VulDB CNA Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:2k_games:sid_meiers_civilization_vi:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Lua sandbox"
          ],
          "product": "Sid Meier\u0027s Civilization VI",
          "vendor": "2K Games",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.12.68"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security flaw has been discovered in 2K Games Sid Meier\u0027s Civilization VI 1.0.12.68. The affected element is the function loadstring of the component Lua sandbox. Performing a manipulation results in type confusion. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-843",
              "description": "Type Confusion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T05:47:29.319Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-426334 | 2K Games Sid Meier\u0027s Civilization VI Lua sandbox loadstring type confusion",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/426334"
        },
        {
          "name": "VDB-426334 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/426334/cti"
        },
        {
          "name": "CVE-2026-116370 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-116370"
        },
        {
          "name": "Submit #1013119 | 2k Games Sid Meier\u2019s Civilization VI 1.0.12.68 Exposed Dangerous Method or Function",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1013119"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://github.com/drbloop2000/Sid-Meier-s-Civilization-VI-RCE"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/drbloop2000/Sid-Meier-s-Civilization-VI-RCE/blob/main/Exploit.lua"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-26T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-26T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-27T06:49:24.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "2K Games Sid Meier\u0027s Civilization VI Lua sandbox loadstring type confusion",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-116370",
    "datePublished": "2026-10-26T16:15:11.957Z",
    "dateReserved": "2026-10-26T08:08:44.693Z",
    "dateUpdated": "2026-10-27T05:47:29.319Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-116370 (GCVE-0-2026-116370)

    Vulnerability from cvelistv5 – Published: 2026-10-26 16:15 – Updated: 2026-10-27 05:47
    VLAI
    Title
    2K Games Sid Meier's Civilization VI Lua sandbox loadstring type confusion
    Summary
    A security flaw has been discovered in 2K Games Sid Meier's Civilization VI 1.0.12.68. The affected element is the function loadstring of the component Lua sandbox. Performing a manipulation results in type confusion. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.
    Severity
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
    6.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
    6.3 (Medium)
    CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
    CWE
    Assigner
    VulDB CNA under the mitre root
    CNA scorecard B 83/100 over 3873 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    2K Games Sid Meier's Civilization VI Affected: 1.0.12.68
        cpe:2.3:a:2k_games:sid_meiers_civilization_vi:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    VulDB CNA Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:2k_games:sid_meiers_civilization_vi:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Lua sandbox"
          ],
          "product": "Sid Meier\u0027s Civilization VI",
          "vendor": "2K Games",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.12.68"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security flaw has been discovered in 2K Games Sid Meier\u0027s Civilization VI 1.0.12.68. The affected element is the function loadstring of the component Lua sandbox. Performing a manipulation results in type confusion. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-843",
              "description": "Type Confusion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T05:47:29.319Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-426334 | 2K Games Sid Meier\u0027s Civilization VI Lua sandbox loadstring type confusion",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/426334"
        },
        {
          "name": "VDB-426334 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/426334/cti"
        },
        {
          "name": "CVE-2026-116370 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-116370"
        },
        {
          "name": "Submit #1013119 | 2k Games Sid Meier\u2019s Civilization VI 1.0.12.68 Exposed Dangerous Method or Function",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1013119"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://github.com/drbloop2000/Sid-Meier-s-Civilization-VI-RCE"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/drbloop2000/Sid-Meier-s-Civilization-VI-RCE/blob/main/Exploit.lua"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-26T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-26T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-27T06:49:24.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "2K Games Sid Meier\u0027s Civilization VI Lua sandbox loadstring type confusion",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-116370",
    "datePublished": "2026-10-26T16:15:11.957Z",
    "dateReserved": "2026-10-26T08:08:44.693Z",
    "dateUpdated": "2026-10-27T05:47:29.319Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}