CVE-2026-116370

A security flaw has been discovered in 2K Games Sid Meier's Civilization VI 1.0.12.68. The affected element is the function loadstring of the component Lua sandbox. Performing a manipulation results in type confusion. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.

• CWE-843

• https://github.com/drbloop2000/Sid-Meier-s-Civilization-VI-RCEExploit, Issue Tracking
• https://github.com/drbloop2000/Sid-Meier-s-Civilization-VI-RCE/blob/main/Exploit.luaProduct
• https://vuldb.com/cve/CVE-2026-116370Third Party Advisory, VDB Entry
• https://vuldb.com/submit/1013119Third Party Advisory, VDB Entry
• https://vuldb.com/vuln/426334Third Party Advisory, VDB Entry
• https://vuldb.com/vuln/426334/ctiThird Party Advisory, VDB Entry

Published

Oct 26, 2026

Last Modified

Oct 29, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11636Use after free in Autofill in Google Chrome on Windows prior…7.5
• CVE-2026-116366An issue has been discovered in ClickHouse Server that, unde…9.5
• CVE-2026-116367A vulnerability was found in DeepSeek Harness up to 0.1.0-rc…6.3
• CVE-2026-116368A vulnerability was determined in DeepSeek Harness up to 0.2…7.3
• CVE-2026-116369A vulnerability was identified in Sunwood-ai-labs github-kan…6.3
• CVE-2026-11637Use after free in Views in Google Chrome on Mac prior to 149…8.8
• CVE-2026-116371A weakness has been identified in Akuvox Akubela HyPanel PS5…6.3
• CVE-2026-116372MISP mispguard is a security filtering proxy that inspects a…7.7
• CVE-2026-11638Use after free in Printing in Google Chrome prior to 149.0.7…9.6
• CVE-2026-116384A weakness has been identified in Bdtask Garage 24 Garage Ma…6.3
• CVE-2026-116385A security vulnerability has been detected in Bdtask Garage …3.5
• CVE-2026-116386Unauthenticated Privilege Escalation in SMS Alert Order Noti…9.8