EUVD-2026-109977
GHSA-x6v8-mwjf-8mrc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPublish malicious Lua mod/map/save
-
DeliveryVictim loads crafted content
-
Exploitloadstring triggers type confusion in Lua sandbox
-
ExecutionCorrupt sandbox memory
-
ImpactInformation disclosure or sandbox escape
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-supplied content (a crafted mod, scenario/map, or save file) that reaches the loadstring function in the game's Lua sandbox, triggering the type confusion. The limiting factors are the required user interaction (UI:P - the victim must choose to load the malicious file; no silent/remote-service trigger is described) and the affected build being version 1.0.12.68. No authentication is required (PR:N). The precise trigger internals beyond 'loadstring type confusion' are not described in the available sources. |
| Impact | Signals point to a genuine but modest priority, not a top-tier emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L) scores 5.3 (medium): network-reachable and unauthenticated (PR:N), low attack complexity, but gated by passive user interaction (UI:P) - a victim must load attacker-supplied content - and all impacts are only Low. The exploit maturity is E:P (proof-of-concept), consistent with the input noting a PoC reference that is not verified as working exploit code. This is NOT in CISA KEV (no active-exploitation signal), and no EPSS probability was provided, so widespread-exploitation likelihood cannot be quantified from the data. The vuln.today decision label is 'this_month' - meaningful but short of act_now/emergency. Conflicts to flag explicitly: the vector asserts AV:N while the actual mechanism is loading a malicious Lua script/mod into a desktop game, which is network-delivered content rather than a remote service exposure - treat 'remote' loosely. Also, the only PoC reference is a GitHub repo named for Civilization VI while this CVE targets Civilization IV - verify the artifact actually matches this product before acting on it. Finally, this is a consumer strategy game with no enterprise/production footprint, so organizational risk is low even though the technical flaw (Lua sandbox type confusion, CWE-843) could in principle enable sandbox escape. |
| Exploit ScenarioDerived | An attacker publishes a malicious mod, scenario map, or save file for Sid Meier's Civilization IV that embeds crafted Lua; a victim downloads and loads it, and the game's loadstring handling in the Lua sandbox triggers a type confusion. Because exploitation requires the victim to open attacker-supplied content (UI:P), it is not a drive-by; a public PoC reference exists but is not verified as working exploit code, so reliability is unproven. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 26, 2026
Type confusion in the Lua sandbox of Sid Meier's Civilization IV 1.0.12.68 lets an attacker who convinces a player to load attacker-supplied content - a crafted mod, scenario/map, or save file - reach the loadstring function and corrupt the game's scripting state, producing limited confidentiality, integrity, and availability impact. No authentication is required (PR:N per both the CVE CVSS 4.0 vector and the assessed CVSS 3.1 vector), but the attacker has no silent trigger: the victim must actively choose to load the malicious file (UI:P/UI:R), and only that specific build is identified as affected. A public proof-of-concept reference exists (a GitHub repository with an Exploit.lua); it is not verified as working exploit code, there is no KEV listing, and the vulnerability-today decision label is 'this_month', indicating a genuine but modest priority rather than a top-tier emergency.
RemediationAI
No vendor-released patch or fixed version is identified in the available sources; the vendor was contacted early about the disclosure, and the VulDB advisory at https://vuldb.com/vuln/426334 (with CTI context at https://vuldb.com/vuln/426334/cti) is the place to watch for an update, so confirm the installed build of Sid Meier's Civilization IV and upgrade as soon as 2K Games publishes a corrected release. Because exploitation depends entirely on the victim loading attacker-supplied content, the practical compensating measure is to treat mods, custom scenarios, maps, and save files from third parties as untrusted: install and load only content from sources you can verify, and avoid opening scenario or save files received from unknown parties. The trade-off is loss of access to community content and convenience, and it is a behavioral control rather than a technical barrier, so it reduces but does not eliminate risk for players who routinely use downloaded mods. Eliminating all untrusted script content is the only measure that fully removes the described attack path short of a vendor fix, since no configuration-level sandbox restriction is documented in the supplied sources that would block loadstring while keeping mod support functional.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Civilization IV exposes a Lua scripting interface so that mods, scenarios, maps, and save games can execute game logic; the loadstring primitive in that embedded sandbox compiles attacker-influenced text into executable Lua. CWE-843 (Type Confusion) means a value of one type is handled as though it were another, which in a scripting bridge typically lets script-supplied data be misinterpreted by the host as an internal object, undermining the isolation the sandbox is meant to provide. The flaw is network-vector and low-complexity per the published vectors, with scope unchanged and only low-level impact on confidentiality, integrity, and availability; the E:P metric in the CVSS 4.0 vector reflects that exploit code is perceived as available. The affected package is catalogued as cpe:2.3:a:2k_games:sid_meier's_civilization_iv with a wildcard version, while EUVD pins the affected build to 1.0.12.68. The precise internals of how the type confusion is triggered beyond 'loadstring type confusion' are not described in the available sources, and the supplied data does not state whether later builds or other distributions of the game are fixed.
Know when Sid Meier S Civilization Iv gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Malicious Lua content is delivered over the network but the victim must load it (UI:R), no auth is needed (PR:N), and impacts are Low per the described type-confusion class without confirmed escape.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in 2K Games Sid Meier's Civilization IV 1.0.12.68. The affected element is the function loadstring of the component Lua sandbox. Performing a manipulation results in type confusion. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB