Sid Meier S Civilization Iv
Monthly
Type confusion in the Lua sandbox of Sid Meier's Civilization IV 1.0.12.68 lets an attacker who convinces a player to load attacker-supplied content - a crafted mod, scenario/map, or save file - reach the loadstring function and corrupt the game's scripting state, producing limited confidentiality, integrity, and availability impact. No authentication is required (PR:N per both the CVE CVSS 4.0 vector and the assessed CVSS 3.1 vector), but the attacker has no silent trigger: the victim must actively choose to load the malicious file (UI:P/UI:R), and only that specific build is identified as affected. A public proof-of-concept reference exists (a GitHub repository with an Exploit.lua); it is not verified as working exploit code, there is no KEV listing, and the vulnerability-today decision label is 'this_month', indicating a genuine but modest priority rather than a top-tier emergency.
Type confusion in the Lua sandbox of Sid Meier's Civilization IV 1.0.12.68 lets an attacker who convinces a player to load attacker-supplied content - a crafted mod, scenario/map, or save file - reach the loadstring function and corrupt the game's scripting state, producing limited confidentiality, integrity, and availability impact. No authentication is required (PR:N per both the CVE CVSS 4.0 vector and the assessed CVSS 3.1 vector), but the attacker has no silent trigger: the victim must actively choose to load the malicious file (UI:P/UI:R), and only that specific build is identified as affected. A public proof-of-concept reference exists (a GitHub repository with an Exploit.lua); it is not verified as working exploit code, there is no KEV listing, and the vulnerability-today decision label is 'this_month', indicating a genuine but modest priority rather than a top-tier emergency.