CVE-2026-14765 Details
Description
Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL). The URL scheme filter (FURLRequestFilter) is empty by default, which permits all URL schemes. On Windows, this results in a call to ShellExecuteW() with the open verb, so a supplied file:/// URI causes the referenced file to be executed. Any Unreal Engine game that loads user-generated content containing Blueprints is vulnerable to command execution via a malicious local file or a remote file on a WebDAV share. This is an instance of CWE-1188 (Initialization of a Resource with an Insecure Default).
A vulnerability exists in Epic Games Unreal Engine versions through 5.8.0, where the LaunchURL Blueprint node is configured to allow all URL schemes by default. This insecure setting enables the execution of local files or files from a WebDAV share via the ShellExecuteW() function on Windows. The vulnerability can be exploited in any Unreal Engine game that incorporates user-generated content with Blueprints.
This vulnerability has been patched in 'Meccha Chameleon' by restricting uploaded files to whitelisted extensions and preventing the 'LaunchURL' function from executing arbitrary file types. However, a default policy in Unreal Engine to limit 'LaunchURL' to safe HTTP or HTTPS links is still needed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 18, 2026CNA
Assessed Jan 1, 1References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://khaelkugler.com/blogs/meccha_chameleon.html | [email protected] | ExploitTechnical Analysis |
| https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000001011111111101111111111110000000000000000000000000000000000000000000000000000001011 | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1188 | Initialization of a Resource with an Insecure Default | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Epic Games Unreal Engine | <= 5.8.0 (semver) |
CPE
Remediation
| |
| Meccha Chameleon | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |