Submit #1013119: 2k Games Sid Meier’s Civilization VI 1.0.12.68 Exposed Dangerous Method or Function

In Civilization IV, a crafted mod could escape the Lua sandbox by crafting fake objects and executing bytecode, which leads to arbitrary memory access. A crafted mod can overwrite a C closure pointer to os.execute, which is normally unavailable in the sandbox, leading to arbitrary code execution, after one click, from a malicious workshop lua script.

I have contacted the Vendor via support tickets as that's the only way to contact them regardless if it's a security issue or not.

First, they told me to "reinstall" and "clear cache" to fix the vulnerability, then they told me they can't foward it to any relevent security or development team because Civilization IV, is a "sunset" title, which makes sense considering the game peaks on average 48k active players on Steam.

Emails: https://imgur.com/a/OiwqJsw
PoC: https://github.com/drbloop2000/Sid-Meier-s-Civilization-VI-RCE

• Source: ⚠️ https://github.com/drbloop2000/Sid-Meier-s-Civilization-VI-RCE
• User: Anonymous User
• Submission: 10/04/2026 14:15 (22 days ago)
• Moderation: 10/26/2026 09:08 (22 days later)
• Status: Accepted
• VulDB entry: 426334 [2K Games Sid Meier's Civilization IV 1.0.12.68 Mod os.execute code injection]
• Points: 20