| tiêu đề | 2k Games Sid Meier’s Civilization VI 1.0.12.68 Exposed Dangerous Method or Function |
|---|
| Mô tả | In Civilization IV, a crafted mod could escape the Lua sandbox by crafting fake objects and executing bytecode, which leads to arbitrary memory access. A crafted mod can overwrite a C closure pointer to os.execute, which is normally unavailable in the sandbox, leading to arbitrary code execution, after one click, from a malicious workshop lua script.
I have contacted the Vendor via support tickets as that's the only way to contact them regardless if it's a security issue or not.
First, they told me to "reinstall" and "clear cache" to fix the vulnerability, then they told me they can't foward it to any relevent security or development team because Civilization IV, is a "sunset" title, which makes sense considering the game peaks on average 48k active players on Steam.
Emails: https://imgur.com/a/OiwqJsw
PoC: https://github.com/drbloop2000/Sid-Meier-s-Civilization-VI-RCE
|
|---|
| Nguồn | ⚠️ https://github.com/drbloop2000/Sid-Meier-s-Civilization-VI-RCE |
|---|
| Người dùng | Anonymous User |
|---|
| Đệ trình | 04/10/2026 14:15 (cách đây 23 ngày) |
|---|
| Kiểm duyệt | 26/10/2026 09:08 (22 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 426334 [2K Games Sid Meier's Civilization VI 1.0.12.68 Lua sandbox loadstring nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|