Civilization V
Monthly
A type-confusion flaw in the Lua Sandbox of Civilization V 1.0.3.144 (function loadstring) lets remote attackers deliver crafted Lua content - a mod, map or scenario - that, once loaded by the victim, corrupts memory and can compromise confidentiality, integrity and availability of the game process. No authentication or privileges are required (CVSS 4.0 vector is PR:N), but the user must actively load the malicious content, which the independent assessment describes as a 'three-click' interaction flow; the reported CVSS 4.0 severity is 5.3 (medium) with Low impacts to each of C/I/A, while the independent CVSS 3.1 assessment rates all three as High. A public PoC reference exists (a VulDB entry and a blog plus GitHub exploit.lua linked from the advisory); it is not verified as working exploit code, and no CISA KEV listing or confirmed active exploitation is present in the supplied data. The vendor was contacted and did not respond, so no fixed version or official mitigation is available.
A type-confusion flaw in the Lua Sandbox of Civilization V 1.0.3.144 (function loadstring) lets remote attackers deliver crafted Lua content - a mod, map or scenario - that, once loaded by the victim, corrupts memory and can compromise confidentiality, integrity and availability of the game process. No authentication or privileges are required (CVSS 4.0 vector is PR:N), but the user must actively load the malicious content, which the independent assessment describes as a 'three-click' interaction flow; the reported CVSS 4.0 severity is 5.3 (medium) with Low impacts to each of C/I/A, while the independent CVSS 3.1 assessment rates all three as High. A public PoC reference exists (a VulDB entry and a blog plus GitHub exploit.lua linked from the advisory); it is not verified as working exploit code, and no CISA KEV listing or confirmed active exploitation is present in the supplied data. The vendor was contacted and did not respond, so no fixed version or official mitigation is available.