Read the docs
TI-2018-12639 Aliases CVE-2018-17707GHSA-8qq2-9gv5-26mw

OS command injection in Epic Games Launcher

Priority MEDIUM 44CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Epic Games Launcher versions prior to 8.2.2. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handler for the com.epicgames.launcher protocol. A crafted URI with the com.epicgames.launcher protocol can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-7241.

Why it matters now

EPSS 0.03004 87th percentileScored 2026-11-07
Fix Fixed Epic Games Launcher (Epic Games): 8.2.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Epic GamesEpic Games Launcherbefore 8.2.28.2.2Patch availableCNA
  • Epic Games Launcher VendorEpic Games Affected before 8.2.2 Fixed in 8.2.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:epicgames:launcher:*:*:*:*:*:*:*:*before 8.2.2VulnerableEpicgames
  • cpe:2.3:a:epicgames:launcher:*:*:*:*:*:*:*:* Versions before 8.2.2 Vulnerable ·Epicgames

Remediation

  • Fix · CNA Epic Games Launcher (Epic Games) Fixed in 8.2.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-17707
  2. 2026-10-03 Alias added: GHSA-8qq2-9gv5-26mw

References

Advisory 1

  • TI-2004-00549 The Unreal Engine, as used in DeusEx 1.112fm and earlier, Devastation 390 and earlier… CVSS 2.0HIGH 10.0
  • TI-2021-22359 Epic Games Psyonix Rocket League <=1.95 Elevation of Privileges via Insecure Permissions CVSS 4.0HIGH 8.5
  • TI-2021-22356 Epic Games Easy Anti-Cheat 4.0 Local Privilege Escalation via Unquoted Service Path CVSS 4.0HIGH 8.5
  • TI-2003-01332 Epic Games Unreal Engine 226f through 436 allows remote attackers to cause a denial of… CVSS 2.0HIGH 10.0
  • TI-2008-03270 Buffer overflow in Unreal Tournament 3 1.3beta4 and earlier allows remote attackers to… CVSS 2.0HIGH 7.5
  • TI-2008-04067 Directory traversal vulnerability in ImageServer (aka UTImageServer) in WebAdmin before… CVSS 2.0HIGH 7.8
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences