TI-2026-73748 Aliases CVE-2026-14765 GHSA-23f6-w88j-75xf

Command execution via insecure URL scheme default in Unreal Engine

LOW 36CWE-1188Published 2026-10-14 · Updated 2026-10-18

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default that leaves the URL scheme filter for the LaunchURL Blueprint node empty, so all URL schemes are allowed (CWE-1188). On Windows, a supplied file:/// URI causes the referenced file to be executed. An attacker who supplies a malicious local file or a remote file on a WebDAV share can run commands in any Unreal Engine game that loads user-generated content containing Blueprints, and the attack requires user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL). The URL scheme filter (FURLRequestFilter) is empty by default, which permits all URL schemes. On Windows, this results in a call to ShellExecuteW() with the open verb, so a supplied file:/// URI causes the referenced file to be executed. Any Unreal Engine game that loads user-generated content containing Blueprints is vulnerable to command execution via a malicious local file or a remote file on a WebDAV share. This is an instance of CWE-1188 (Initialization of a Resource with an Insecure Default).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00387 32nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Epic Games	Unreal Engine	up to 5.8.0	—	No fix listed	CNA

Unreal Engine VendorEpic Games Affected up to 5.8.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Unreal Engine.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

2026-10-14 Threatist record created from CVE-2026-14765
2026-10-14 Alias added: GHSA-23f6-w88j-75xf
2026-10-14 Priority changed: MEDIUM → LOW
2026-10-18 CISA SSVC decision points changed

References

Advisory 1

https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000001011111111101111111111110000000000000000000000000000000000000000000000000000001011

Other 1

https://khaelkugler.com/blogs/meccha_chameleon.html

TI-2004-00549 The Unreal Engine, as used in DeusEx 1.112fm and earlier, Devastation 390 and earlier… CVSS 2.0HIGH 10.0
TI-2021-22359 Epic Games Psyonix Rocket League <=1.95 Elevation of Privileges via Insecure Permissions CVSS 4.0HIGH 8.5
TI-2021-22356 Epic Games Easy Anti-Cheat 4.0 Local Privilege Escalation via Unquoted Service Path CVSS 4.0HIGH 8.5
TI-2003-01332 Epic Games Unreal Engine 226f through 436 allows remote attackers to cause a denial of… CVSS 2.0HIGH 10.0
TI-2008-03270 Buffer overflow in Unreal Tournament 3 1.3beta4 and earlier allows remote attackers to… CVSS 2.0HIGH 7.5
TI-2018-12639 OS command injection in Epic Games Launcher CVSS 3.0HIGH 8.8

See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences