CVE-2026-14765

Deferred Deferred - Pending Action

Unreal Engine URL Scheme Command Execution via Blueprint

Publication date: 2026-10-14

Last updated on: 2026-10-18

Assigner: Austin Hackers Anonymous

Description

Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL). The URL scheme filter (FURLRequestFilter) is empty by default, which permits all URL schemes. On Windows, this results in a call to ShellExecuteW() with the open verb, so a supplied file:/// URI causes the referenced file to be executed. Any Unreal Engine game that loads user-generated content containing Blueprints is vulnerable to command execution via a malicious local file or a remote file on a WebDAV share. This is an instance of CWE-1188 (Initialization of a Resource with an Insecure Default).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-14765

EUVD

EUVD-2026-100781

Affected Vendors & Products

Vendor	Product	Version / Range
Epic	Games	Unreal Engine 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1188	The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Attack-Flow Graph

Executive Summary

CVE-2026-14765 is an insecure default configuration in Epic Games Unreal Engine up to 5.8.0. The LaunchURL Blueprint node allows execution of arbitrary files via ShellExecuteW on Windows. By default, it permits all URL schemes, enabling command execution if a malicious file is referenced. This affects games using Unreal Engine that load user-generated Blueprints.

Detection Guidance

Check Unreal Engine projects for Blueprint scripts using the LaunchURL node. Inspect custom maps in Steam Workshop for unexpected file types like .bat or .exe. Monitor system logs for ShellExecuteW calls from Unreal Engine processes.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on your system. If you play a vulnerable Unreal Engine game with user-generated content, downloading a malicious map could trigger file execution without significant user interaction. Attackers could deliver malware, steal data, or gain control of your system.

Compliance Impact

This vulnerability could lead to unauthorized code execution on user systems, potentially compromising sensitive data. For GDPR, it may result in unauthorized access to personal data, violating principles of data protection and user consent. For HIPAA, it could allow access to protected health information if exploited in healthcare-related applications. The risk of remote code execution undermines compliance with security and privacy requirements in both standards.

Mitigation Strategies

Update Unreal Engine to the latest version. Disable Workshop map auto-downloads. Restrict file types allowed in custom maps. Review Blueprint scripts for suspicious LaunchURL usage.

Hi! I’m here to help you understand CVE-2026-14765. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70