CVE-2026-14765

HIGH 7.7

Epic Games Unreal Engine Insecure Default URL Scheme Allowance in LaunchURL

CVSS Score

7.7

EPSS Score

0.0%

EPSS Percentile

0th

Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL). The URL scheme filter (FURLRequestFilter) is empty by default, which permits all URL schemes. On Windows, this results in a call to ShellExecuteW() with the open verb, so a supplied file:/// URI causes the referenced file to be executed. Any Unreal Engine game that loads user-generated content containing Blueprints is vulnerable to command execution via a malicious local file or a remote file on a WebDAV share. This is an instance of CWE-1188 (Initialization of a Resource with an Insecure Default).

CWE	CWE-1188
Vendor	epic games
Product	unreal engine
Published	Oct 14, 2026

Stay Ahead of the Next One

Get instant alerts for epic games unreal engine

Be the first to know when new high vulnerabilities affecting epic games unreal engine are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Epic Games / Unreal Engine

0 ≤ 5.8.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

khaelkugler.com: https://khaelkugler.com/blogs/meccha_chameleon.html takeonme.org: https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000001011111111101111111111110000000000000000000000000000000000000000000000000000001011

Credits

Khael Kugler todb of AHA!