Civilization V CVE-2026-116111

Exploitation requires a victim running Civilization V 1.0.3.144 to load attacker-supplied Lua content (a mod, map, or scenario) that reaches the loadstring function in the game's Lua Sandbox, triggering the type confusion - this is the user interaction captured by UI:P and described as a 'three-click' flow. No authentication or special privileges are needed (PR:N). The decisive limiting factor is that the malicious content must be actively loaded by the user; there is no automatic or server-side trigger, so exploitation is targeted and social-engineering-dependent rather than unattended. No vendor-confirmed fixed version or official mitigation is available, as the vendor did not respond.

The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P, VC:L/VI:L/VA:L, E:P) yields a medium 5.3 and signals remote delivery with no privileges but with required user interaction and only Low impact to each of confidentiality, integrity and availability. This conflicts sharply with the researcher write-up, whose title ('three-click RCE in Civ V') and PoC repository name claim full remote code execution - the CVE Description itself establishes only a type confusion (CWE-843) in the Lua Sandbox loadstring function, so the true impact is unresolved and should be verified before trusting either extreme. There is no CISA KEV listing and no EPSS score in the supplied data, so widespread or automated exploitation is not evidenced; the E:P (Proof-of-Concept) maturity and the this_month vuln.today decision label both point to a real-but-not-emergency priority. The hard limiter is UI: exploitation needs a victim to load attacker-supplied Lua content, which rules out unattended mass exploitation and makes this a targeted, social-engineering-dependent client-side issue rather than a server-side wormable flaw. Net: patch/mitigate on a normal (this-month) cadence, but resolve the impact discrepancy (Low vs. claimed RCE) with an independent look at the PoC rather than accepting the RCE claim as confirmed.

An attacker crafts a malicious Civilization V mod, map, or scenario containing Lua that abuses the loadstring function in the game's Lua Sandbox, then distributes it (e.g. via Steam Workshop or a shared file); when a victim loads it in version 1.0.3.144 the type confusion is triggered, causing memory corruption and, per the researcher, client-side code execution. A public PoC reference exists (a GitHub exploit.lua and a blog write-up); it is not verified as working exploit code. The 'three-click' interaction and required loading of untrusted content mean exploitation depends on user action, not automation.