CVE-2026-14765
7.7HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-1188
Impact
Attackers can execute arbitrary code on Windows clients running games that load untrusted user-generated content. Exploitation requires convincing a user to load a malicious Blueprint containing a file:/// URI pointing to a local or WebDAV-hosted executable.
Root cause
The LaunchURL Blueprint node initializes an empty URL scheme filter by default, causing ShellExecuteW() to execute arbitrary files referenced via file:/// schemes.
Affected systems
Epic Games Unreal Engine up to and including 5.8.0
CVSS v3.1 · CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Fix & remediation
Upgrade past version 5.8.0 once an official patched release is available. In the interim, configure FURLRequestFilter to block the file:/// scheme or disable loading untrusted user-generated Blueprints.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL). The URL scheme filter (FURLRequestFilter) is empty by default, which permits all URL schemes. On Windows, this results in a call to ShellExecuteW() with the open verb, so a supplied file:/// URI causes the referenced file to be executed. Any Unreal Engine game that loads user-generated content containing Blueprints is vulnerable to command execution via a malicious local file or a remote file on a WebDAV share. This is an instance of CWE-1188 (Initialization of a Resource with an Insecure Default).