Epic Games Unreal Engine 226f through 436 does not validate the challenge key, which…
Priority LOW 22CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · None · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-287.
Summary
Epic Games Unreal Engine 226f through 436 does not validate the challenge key, which allows remote attackers to exhaust the player limit by joining the game multiple times.
Why it matters now
EPSS 0.01179 67th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:epic_games:unreal_engine:226f:*:*:*:*:*:*:* | 226f | Vulnerable | Epic Games |
| cpe:2.3:a:epic_games:unreal_engine:433:*:*:*:*:*:*:* | 433 | Vulnerable | Epic Games |
| cpe:2.3:a:epic_games:unreal_engine:436:*:*:*:*:*:*:* | 436 | Vulnerable | Epic Games |
- cpe:2.3:a:epic_games:unreal_engine:226f:*:*:*:*:*:*:* Versions 226f Vulnerable ·Epic Games
- cpe:2.3:a:epic_games:unreal_engine:433:*:*:*:*:*:*:* Versions 433 Vulnerable ·Epic Games
- cpe:2.3:a:epic_games:unreal_engine:436:*:*:*:*:*:*:* Versions 436 Vulnerable ·Epic Games
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2003-1433
- 2026-10-03 Alias added: GHSA-q959-v446-rf26
References
More Epic Games Unreal Engine vulnerabilities
- TI-2004-00549 The Unreal Engine, as used in DeusEx 1.112fm and earlier, Devastation 390 and earlier… CVSS 2.0HIGH 10.0
- TI-2003-01332 Epic Games Unreal Engine 226f through 436 allows remote attackers to cause a denial of… CVSS 2.0HIGH 10.0
- TI-2003-01331 Buffer overflow in Epic Games Unreal Engine 226f through 436 allows remote attackers to… CVSS 2.0HIGH 7.1
- TI-2004-01680 Format string vulnerability in games using the Epic Games Unreal Engine 436 allows remote… CVSS 2.0MEDIUM 5.0
- TI-2007-04302 Stack-based buffer overflow in the logging function in the Unreal engine, possibly 2003… CVSS 2.0MEDIUM 5.0
- TI-2003-01330 Directory traversal vulnerability in Unreal Tournament Server 436 and earlier allows… CVSS 2.0MEDIUM 5.0
Sources
- CVE-2003-1433 · CVE Program
- CVE-2003-1433 · NVD
- FIRST EPSS
- GHSA-q959-v446-rf26 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences