CVE-2026-116111 2K Games CVE debrief

Who should care

Defenders of Civilization V 1.0.3.144 deployments, security teams, and vulnerability management teams should assess exposure and verify remediation status. Operators and administrators of affected systems should also be aware of the vulnerability and take necessary precautions. The vulnerability's impact on the system and its users should be carefully evaluated to determine the necessary course of action.

Why it matters

CVE-2026-116111 is a type confusion vulnerability in 2K Games Civilization V 1.0.3.144, specifically in the Lua Sandbox loadstring function. Defenders should assess exposure, verify vendor remediation status, and monitor for exploitation attempts.

• Verify potential remote exploitation vectors
• Assess exposure of Civilization V 1.0.3.144 deployments
• Monitor for exploitation attempts

Technical summary

The loadstring function in 2K Games Civilization V 1.0.3.144 Lua Sandbox is vulnerable to type confusion, potentially allowing remote exploitation. The vulnerability exists due to improper handling of Lua script execution. Defenders should assess exposure and verify remediation status. The technical details of the vulnerability are based on the CVE record and source item, which provide limited information on the vulnerability's impact and exploitability. Further analysis is needed to fully understand the vulnerability's effects.

Defensive priority

Assess exposure of Civilization V 1.0.3.144 deployments, verify vendor remediation status, and monitor for exploitation attempts.

Recommended defensive actions

• Assess exposure of Civilization V 1.0.3.144 deployments
• Verify vendor remediation status
• Monitor for exploitation attempts
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record and source item provide details on the vulnerability, but vendor comments and additional impact information are lacking. The source item and CVE Program record provide evidence of the vulnerability's existence, but further verification is needed to assess exposure and remediation status. The NVD entry and other sources do not provide additional information on exploitation attempts or vendor response.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.