ZDI-18-1359: Epic Games Launcher Protocol Command Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Visual Studio with tools for Unreal Engine development installed. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handler for the com.epicgames.launcher protocol. A crafted URI with the com.epicgames.launcher protocol can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of the current user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-18-1359?
ZDI-18-1359 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix ZDI-18-1359?
To mitigate ZDI-18-1359, ensure you update Microsoft Visual Studio and your Unreal Engine development tools to the latest version.
Who is affected by ZDI-18-1359?
ZDI-18-1359 affects users of Microsoft Visual Studio with Unreal Engine development tools installed.
What type of attack does ZDI-18-1359 involve?
ZDI-18-1359 involves remote code execution attacks requiring user interaction through a malicious webpage.
What software needs to be updated to remediate ZDI-18-1359?
The vulnerable installation of Microsoft Visual Studio and its associated Unreal Engine development tools need to be updated.