CVE-2026-14765: Epic Games Unreal Engine Insecure Default URL Scheme Allowance in LaunchURL#

AHA! has discovered an issue with Unreal Engine 5.8.0 from Epic Games, and is publishing this disclosure in accordance with AHA!’s standard disclosure policy today, on Tuesday, October 13, 2026. CVE-2026-14765 has been assigned to this issue.

This vulnerability is estimated to have a CVSSv3.1 rating of CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H (7.7 High), and the relevant SSVC vectors are Exploitation: PoC, Technical Impact: Total and Automatable: Yes.

Any questions about this disclosure should be directed to [email protected].

Executive Summary#

Epic Games Unreal Engine <= 5.8.0 ships with an insecure default configuration for the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL). The node’s URL scheme filter FURLRequestFilter is empty by default, permitting all URL schemes. On Windows, this function results in a call to ShellExecuteW() with the open parameter, meaning supplied file:/// URIs will cause the referenced file to be executed. Any Unreal Engine game that loads user-generated content containing Blueprints is vulnerable to command execution via a malicious local file or a remote file on a WebDAV share.

This vulnerability has recently been demonstrated in MECCHA CHAMELEON, a popular UE5 game where a lobby host can achieve arbitrary command execution on all lobby participants via a malicious Steam Workshop map. This is an instance of CWE-1188: “Initialization of a Resource with an Insecure Default.”

Technical Details#

The LaunchURL Blueprint node is exposed as UFUNCTION(BlueprintCallable) in KismetSystemLibrary.h. When called:

  1. UKismetSystemLibrary::LaunchURL() (KismetSystemLibrary.cpp:2853) creates a FURLRequestFilter from the [SystemLibrary.LaunchURLFilter] configuration section. No default entries exist, so AllowedRequests is empty.

  2. FURLRequestFilter::IsRequestAllowed() (URLRequestFilter.cpp:87) checks if AllowedRequests is empty. If so, it returns true (allow all). This is the insecure default.

  3. FPlatformProcess::LaunchURLFiltered() (GenericPlatformProcess.cpp:265) passes, calling FPlatformProcess::LaunchURL().

  4. On Windows, FWindowsPlatformProcess::LaunchURLInternal() (WindowsPlatformProcess.cpp:477) first checks the ShouldLaunchUrl delegate (bound by HttpModule.cpp:141), which can cancel the request. However, this delegate only performs domain validation for http and https schemes. For all other schemes it returns true unconditionally (HttpModule.cpp:55), allowing execution to continue.

  5. For schemes that aren’t http or https, LaunchDefaultHandlerForURL() (WindowsPlatformProcess.cpp:448) calls ShellExecuteW(NULL, "open", URL, NULL, NULL, SW_SHOWNORMAL), executing arbitrary scheme handlers like file:///.

  6. Multiple filetypes, when called with open on Windows, execute code without user interaction. For example, these include native executables (like .exe or .com), command processor scripts (.bat, .cmd), Windows Script Host scripts (.vbs), installers (.msi), and shortcuts (.lnk).

Attacker Value#

Any user who can publish user-generated content containing Blueprints can achieve arbitrary command execution on players who download their content in an Unreal Engine game. The attacker controls both the payload file and the Blueprint that triggers it. Once code execution is achieved, an attacker could install malware, exfiltrate data, or establish persistence on the victim’s machine.

Note also that local file triggered vulnerabilities (AV:L) tend to also require user interaction (UI:R), and this bug is no different. Victims must first download and load the poisoned Blueprint. However, in games that support user-generated content, loading third-party Blueprints is a routine part of gameplay. Players have no indication that a Blueprint contains a URI scheme other than http or https, making this user interaction trivial to induce. So, while the CVSS vectors are AV:L and UI:R, they mask the true automatable nature of this vulnerability.

Mitigation Suggestion#

Epic Games accommodates gamers, publishers, and modders with a flexible mechanism for custom content in Unreal Engine. For URL handlers beyond http and https, the FURLRequestFilter and its [SystemLibrary.LaunchURLFilter] configuration section already support per-scheme allowlisting with domain restrictions. However, as CWE-1188 describes, a more secure default is desirable. The engine should deny all schemes when no filter is configured (i.e., FURLRequestFilter::IsRequestAllowed() should return false when AllowedRequests is empty), and ship a default allowlist of http and https in BaseEngine.ini. Game creators who need additional URI schemes like steam:// can explicitly opt in via their project’s DefaultEngine.ini.

Credit#

This issue is being disclosed through the AHA! CNA and is credited to Khael Kugler, lead security engineer and researcher at Praetorian.

Timeline#

  • 2026-07-02 (Thu): Initial findings as affecting MECCHA CHAMELEON presented at AHA! Meeting 0x00ed
  • 2026-07-03 (Fri): PoC validated and this disclosure drafted
  • 2026-07-06 (Mon): Disclosed to Epic Games via [email protected], autoreply collected
  • 2026-10-13 (Tue): Public disclosure of CVE-2026-14765