Unreal Engine ships with a default setting that can let community-made content open and run files on a player’s Windows PC, according to a vulnerability record published on 14 October. The researcher who found it says Epic Games has sent only an automatic reply since he reported it in July, and the hotfix Epic released a week after the disclosure doesn’t mention it.
The flaw, CVE-2026-14765, is in LaunchURL, a Blueprint node that games use to open web links. Unreal checks those links against a filter, but the filter’s list of allowed link types is empty by default, and an empty list lets everything through. That includes links that point to files on the player’s own machine. The record covers Unreal Engine versions up to and including 5.8.0, rates the issue 7.7 out of 10, or High, and classes it as an insecure default (CWE-1188).
Any Unreal game that loads Blueprints made by its players, such as custom maps or mods, may be affected. Games that don’t load player-made Blueprints aren’t.
How a map ends up running a program
The advisory from AHA!, the Austin, Texas hacker group that assigned the CVE, explains the chain. On Windows, LaunchURL hands any link that isn’t http or https to the operating system’s “open” command. If the link points to a file, Windows opens it the way it would if you double-clicked it, and for file types such as .exe, .bat, .cmd, .vbs, .msi and .lnk, opening means running.
A malicious map or mod therefore only needs to save a file somewhere on the PC and then point LaunchURL at it. AHA! says the official score understates the risk for games built around user content. The score assumes the attacker needs local access and the player has to do something, but in a game with a Workshop the player’s only action is loading a map.
Found through a hide-and-seek hit
Khael Kugler, a lead security engineer at Praetorian, traced the problem to the engine while looking at MECCHA CHAMELEON, a $5.99 hide-and-seek game built in Unreal Engine 5 that came out on Steam in June. It was a surprise hit. SteamDB recorded a peak of 340,534 players on 21 June, and the developer said it had sold 20 million copies in just over two months, Game Developer reported. Players share custom maps through the Steam Workshop.
In a write-up first posted on 21 June and updated as events unfolded, Kugler showed that a Workshop map could run code on the computer of every player who loaded it. He noted that one Workshop map had 2 million subscriptions and that Workshop items update automatically, so a map that was harmless when someone subscribed could be changed later.
Attackers used the route in July. A map called “Laser Tag Neon” carried a hidden Blueprint that wrote a batch file to the player’s Documents folder and then ran PowerShell to fetch more code, CyberInsider reported. Digital Trends first reported that the second stage failed to download, and later reports said the final payload installed a remote access trojan. No source has given a count of affected players. A follow-up map was removed too, and in a separate incident an infected test machine led to the takeover of an admin account on the game’s Discord server. The developers said that machine “had no access to the game’s source code.”
The developers fixed the game in two steps. First they limited which file types maps could use, then, on 25 July, they stopped LaunchURL from launching arbitrary files.
Kugler says the fix belongs in the engine
MECCHA CHAMELEON is patched, but the default that made it vulnerable is still in Unreal. “I’d still say Epic needs to set this as a default,” Kugler wrote.
Unreal already lets developers restrict LaunchURL. The filter is set in the engine’s configuration files under a section called LaunchURLFilter, through a list named AllowedRequests. A studio that fills in that list is protected. One that never touches it is exposed, and nothing in the engine warns it.
AHA!’s advisory asks Epic to change three things: treat an empty list as “block everything”, ship Unreal with only http and https allowed, and make games that need other link types, such as steam://, add them deliberately.
Epic’s only reply was automatic
According to the advisory, Kugler presented the findings at an AHA! meeting on 2 July and disclosed the issue to Epic on 6 July. He received an autoreply. No other response is recorded before AHA! published the details on 13 October, 99 days later.
Epic’s security page points researchers to an email address and a HackerOne program. That program’s policy offers “neither bounties nor swag” and sets targets of five business days for a first response and ten for triage. It’s not clear which channel AHA! used, so we can’t say whether Epic missed those targets.
Epic released Unreal Engine 5.8 in June and has called it “the last planned major Unreal Engine 5 release on our roadmap as we ramp up work on UE6.” Its 5.8.4 hotfix, posted on 20 October, doesn’t mention LaunchURL or the CVE.
Unreal powers a huge share of PC games. SteamDB’s technology index counts more than 20,000 games on Steam built with it, and calls that an estimate that probably undercounts. Competitive titles are part of that list: Valorant moved to Unreal Engine 5 in July 2025. Valorant doesn’t load player-made maps, so this flaw doesn’t apply to it. The risk sits with games that let players share maps and mods, the feature attackers used against MECCHA CHAMELEON.
What players can do
The CVE record lists no fixed version, so until Epic changes the default, each studio has to set its own filter. Players can lower their risk by installing maps and mods only from creators they trust, and by being wary of new uploads that suddenly climb the Workshop charts. Steam has had to deal with malicious uploads before, and Valve tightened its security after attackers pushed malware through game updates.
Epic has not published a fix or a statement about the flaw.
