CVE-2026-116370

CriticalCVSS 9.6/10Last modified Nov 6, 2026

Description

A security flaw has been discovered in 2K Games Sid Meier's Civilization VI 1.0.12.68. The affected element is the function loadstring of the component Lua sandbox. Performing a manipulation results in type confusion. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The patch is named Hotfix November 2026. The vendor was contacted early about this disclosure.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-843

Affected software

Vendor	Product	Versions
2K Games	Sid Meier's Civilization VI	1.0.12.68

References

https://github.com/drbloop2000/Sid-Meier-s-Civilization-VI-RCEExploit, Issue Tracking
https://github.com/drbloop2000/Sid-Meier-s-Civilization-VI-RCE/blob/main/Exploit.luaProduct
https://store.steampowered.com/news/app/289070/view/695403007258394835?l=english
https://vuldb.com/cve/CVE-2026-116370Third Party Advisory, VDB Entry
https://vuldb.com/submit/1013119Third Party Advisory, VDB Entry
https://vuldb.com/vuln/426334Third Party Advisory, VDB Entry
https://vuldb.com/vuln/426334/ctiThird Party Advisory, VDB Entry

Timeline

Published: Oct 26, 2026
Last modified: Nov 6, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-1163716.3A weakness has been identified in Akuvox Akubela HyPanel PS51 51.130.40.26. The impacted element is an unknown function of the file /login. CVE-2026-1163727.7MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses based on configured rules. The process_feed_respon CVE-2026-1163763.4IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct a phishing attack due to an open redire CVE-2026-116389.6Use after free in Printing in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a CVE-2026-1163846.3A weakness has been identified in Bdtask Garage 24 Garage Management Software 1.0. This vulnerability affects unknown code of the component CVE-2026-1163853.5A security vulnerability has been detected in Bdtask Garage 24 Garage Management Software 1.0. This issue affects some unknown processing of CVE-2026-1163869.8Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions.CVE-2026-1163875.3Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security CVE-2026-1163885.3Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This CVE-2026-1163898.8Deserialization of Untrusted Data vulnerability in crossi72 Phoenix Media Rename phoenix-media-rename allows Object Injection.This issue aff CVE-2026-116397.5Use after free in Compositing in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via a craf CVE-2026-1163907.2Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything — WordPress & WooCommerce Filters filter-everything