CVE-2026-116111: Civilization V Lua Sandbox Type Confusion RCE (vendor non-responsive)

CVE-2026-116111 is a CWE-843 (Type Confusion) vulnerability in the Lua modding sandbox of Civilization V, where the loadstring function can be made to execute crafted bytecode that escapes the sandbox and runs arbitrary code on the player's machine, requires the victim to load a malicious mod (hence the public PoC's "three-click" framing), and remains unfixed because 2K Games has not responded to the researcher's disclosure.

CVE-2026-116111 affects Sid Meier's Civilization V, the long-running 2K Games strategy title whose modding system executes Lua scripts bundled with user-created mods. NVD's own record of the flaw, built on the CNA submission, states: "Impacted is the function loadstring of the component Lua Sandbox. Executing a manipulation can lead to type confusion. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way" (NVD).

The researcher who found the flaw ("drbloop") published both a technical write-up and a working proof-of-concept exploit. The PoC repository's own description confirms the mechanism in general terms: "it is possible to execute arbitrary code and escape the Lua sandbox in Civilization V and VI from a crafted Lua mod by using loadstring and executing crafted bytecode" (drbloop2000/Sid-Meier-s-Civilization-V-RCE, GitHub). The researcher's companion blog post, titled "Three-Click RCE in Sid Meier's V," is a JavaScript-rendered single-page site that returns no readable content to an automated fetch; this page relies on the NVD record and the GitHub proof-of-concept repository instead, and that limitation is disclosed here rather than guessed at.

NVD's own analysis rates this CVSS v3.1 Primary 9.6 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H — network attack vector, low complexity, no privileges but requiring user interaction (installing/loading the malicious mod), with a scope change because code execution in the sandboxed Lua environment escapes into the host process. The original submitter, VulDB, scored it far lower at Secondary 6.3 (S:U, no scope change, only limited confidentiality/integrity/availability impact); this page follows NVD's own Primary rating as authoritative because NVD's analysts independently reviewed the sandbox-escape claim and disagreed with VulDB's narrower read (NVD).

As of this review, there is no vendor advisory, no patched version, and no indication 2K Games has acknowledged the report; the only mitigation available to players is to avoid installing or subscribing to untrusted third-party mods, since the modding workflow (download a Workshop/community mod → load it in-game) is the delivery mechanism the researcher demonstrates. A related sibling flaw, CVE-2026-116370, affects the same loadstring/Lua-sandbox pattern in Civilization VI 1.0.12.68, indicating the vulnerable sandbox code is shared across at least two titles in the franchise (NVD record for CVE-2026-116370).

The CVE is confirmed absent from the live CISA KEV catalog by exact cveID match, and FIRST scores the probability of exploitation at 0.00303 (23.109th percentile) as of 2026-10-30 — a modest figure for a consumer single-player/mod-based game rather than an internet-facing service, but notably non-trivial given the public PoC and total absence of a vendor fix (FIRST EPSS; CISA KEV catalog). Until 2K Games ships a fix, players should treat Civilization V (and VI) mods from unverified sources as a code-execution risk, not merely a gameplay customization.

• The loadstring function of Civilization V's Lua Sandbox component contains a type-confusion flaw reachable remotely (via a loaded mod); the exploit has been publicly disclosed, and the vendor was contacted early about this disclosure but did not respond in any way. — NVD
• A crafted Lua mod using loadstring with crafted bytecode can escape the Lua sandbox in Civilization V and VI and execute arbitrary code; the researcher's companion blog post is a JavaScript-rendered page that returns no static content to automated fetch, so this page relies on NVD and the GitHub PoC repository instead. — drbloop2000/Sid-Meier-s-Civilization-V-RCE, GitHub
• NVD Primary CVSS v3.1 base score is 9.6 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H; the originating CNA (VulDB) Secondary score is far lower, 6.3, with no scope change. — NVD
• A sibling CVE, CVE-2026-116370, documents the same loadstring/Lua-sandbox type-confusion pattern in Civilization VI 1.0.12.68, also with no fixed version published. — NVD record for CVE-2026-116370
• EPSS score is 0.00303 (23.109th percentile) as of 2026-10-30; the CVE is confirmed absent from the live CISA KEV catalog by exact cveID match this run. — FIRST EPSS