Vulnerability · Published Oct 14, 2026 · Assigned by AHA
CVE-2026-14765Epic Games Unreal Engine Insecure Default URL Scheme Allowance in LaunchURL
High 7.7
In plain English
A high-severity security flaw in Unreal Engine from Epic Games. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Official description
Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL). The URL scheme filter (FURLRequestFilter) is empty by default, which permits all URL schemes. On Windows, this results in a call to ShellExecuteW() with the open verb, so a supplied file:/// URI causes the referenced file to be executed. Any Unreal Engine game that loads user-generated content containing Blueprints is vulnerable to command execution via a malicious local file or a remote file on a WebDAV share. This is an instance of CWE-1188 (Initialization of a Resource with an Insecure Default).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Epic Games | Unreal Engine | 0 – through 5.8.0 |
Weakness: CWE-1188 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H