CVE-2026-14765: Epic Games Unreal Engine Insecure Default URL Scheme Allowance in LaunchURL
Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL). The URL scheme filter (FURLRequestFilter) is empty by default, which permits all URL schemes. On Windows, this results in a call to ShellExecuteW() with the open verb, so a supplied file:/// URI causes the referenced file to be executed. Any Unreal Engine game that loads user-generated content containing Blueprints is vulnerable to command execution via a malicious local file or a remote file on a WebDAV share. This is an instance of CWE-1188 (Initialization of a Resource with an Insecure Default).
Affected Software
Event History
Frequently Asked Questions
Which projects are exposed to this issue?
Unreal Engine games that load user-generated content containing Blueprints are exposed. The affected engine versions are up to and including 5.8.0.
What does an attacker need to exploit this?
An attacker needs to get a Blueprint containing a supplied URL processed by the game through user-generated content. On Windows, a file:/// URI can cause the referenced local file or a file on a WebDAV share to be executed.
Is the default configuration affected?
Yes. The FURLRequestFilter used by the LaunchURL Blueprint node is empty by default, which permits all URL schemes.
How can I determine whether my game is affected?
Check whether the game uses an Unreal Engine version up to and including 5.8.0, accepts or loads user-generated Blueprint content, and invokes the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL). Windows builds are specifically affected by the ShellExecuteW open-verb behavior described.