CVE-2026-116370

6.3 MEDIUMpublic exploit available

Published 2026-10-26 · Updated 2026-10-27

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

A security flaw has been discovered in 2K Games Sid Meier's Civilization VI 1.0.12.68. The affected element is the function loadstring of the component Lua sandbox. Performing a manipulation results in type confusion. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Weaknesses

CWE-843

Public exploit & PoC references

https://github.com/drbloop2000/Sid-Meier-s-Civilization-VI-RCE
https://github.com/drbloop2000/Sid-Meier-s-Civilization-VI-RCE/blob/main/Exploit.lua

All references

https://github.com/drbloop2000/Sid-Meier-s-Civilization-VI-RCE
https://github.com/drbloop2000/Sid-Meier-s-Civilization-VI-RCE/blob/main/Exploit.lua
https://vuldb.com/cve/CVE-2026-116370
https://vuldb.com/submit/1013119
https://vuldb.com/vuln/426334
https://vuldb.com/vuln/426334/cti

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

UNSCOREDCVE-2026-0314
HIGHCVE-2026-100792
MEDIUMCVE-2026-100793
UNSCOREDCVE-2026-101912PoC
HIGHCVE-2026-102203
HIGHCVE-2026-102216
HIGHCVE-2026-102299
HIGHCVE-2026-102321

Related by shared AI tags and CWE weakness class. Browse the full archive.