Critical severity · published Oct 26, 2026
CVE-2026-116370
2K Games Sid Meier's Civilization VI Lua sandbox loadstring type confusion
New
10.0
CVSS
0.3%
EPSS
No
On KEV
Description
A security flaw has been discovered in 2K Games Sid Meier's Civilization VI 1.0.12.68. The affected element is the function loadstring of the component Lua sandbox. Performing a manipulation results in type confusion. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
Sid Meier's Civilization VI · 2K Games
1.0.12.68 · source: vendor
SM
Sid Meiers Civilization VI · 2k
1.0.12.68 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116370
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116370
github.com
https://github.com/drbloop2000/Sid-Meier-s-Civilization-VI-RCE
github.com
https://github.com/drbloop2000/Sid-Meier-s-Civilization-VI-RCE/blob/main/Exploit.lua
vuldb.com
https://vuldb.com/cve/CVE-2026-116370
vuldb.com
https://vuldb.com/submit/1013119
vuldb.com
https://vuldb.com/vuln/426334
vuldb.com
https://vuldb.com/vuln/426334/cti