| 제목 | 2k Games Sid Meier’s Civilization VI 1.0.12.68 Exposed Dangerous Method or Function |
|---|
| 설명 | In Civilization IV, a crafted mod could escape the Lua sandbox by crafting fake objects and executing bytecode, which leads to arbitrary memory access. A crafted mod can overwrite a C closure pointer to os.execute, which is normally unavailable in the sandbox, leading to arbitrary code execution, after one click, from a malicious workshop lua script.
I have contacted the Vendor via support tickets as that's the only way to contact them regardless if it's a security issue or not.
First, they told me to "reinstall" and "clear cache" to fix the vulnerability, then they told me they can't foward it to any relevent security or development team because Civilization IV, is a "sunset" title, which makes sense considering the game peaks on average 48k active players on Steam.
Emails: https://imgur.com/a/OiwqJsw
PoC: https://github.com/drbloop2000/Sid-Meier-s-Civilization-VI-RCE
|
|---|
| 원천 | ⚠️ https://github.com/drbloop2000/Sid-Meier-s-Civilization-VI-RCE |
|---|
| 사용자 | Anonymous User |
|---|
| 제출 | 2026. 10. 04. PM 02:15 (23 날 ago) |
|---|
| 모더레이션 | 2026. 10. 26. AM 09:08 (22 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 426334 [2K Games Sid Meier's Civilization VI 1.0.12.68 Lua sandbox loadstring 권한 상승] |
|---|
| 포인트들 | 20 |
|---|