Unreal Engine CVE-2026-14765

Requires an Unreal Engine game or application (versions up to and including 5.8.0) that loads user-generated content containing Blueprints, running on Windows, with the default empty FURLRequestFilter (so all URL schemes, including file:///, are permitted). The attacker must deliver a malicious file either locally or via a WebDAV share, and the victim must load/interact with the malicious UGC (UI:R). Limiting factors that reduce real-world risk: Windows-only (depends on ShellExecuteW behavior), only affects titles that actually ingest third-party Blueprints, requires user interaction to load the content, and is rated high attack complexity; engines reconfigured with a non-empty scheme allowlist are not exploitable.

This is a genuine but conditionally-gated code-execution issue rather than a drop-everything internet-facing emergency. The provided CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H = 7.7 High) tells a consistent story: no privileges needed (PR:N), but the attack is local (AV:L), requires victim interaction (UI:R), and is of high complexity (AC:H), with a scope change (S:C) reflecting that a game-engine Blueprint pivots into OS-level command execution. There is a notable signal tension worth flagging: the description states the file can be delivered 'via a WebDAV share,' which sounds network-adjacent, yet the vector is scored AV:L - this is defensible because the malicious file must still be referenced and loaded by the engine through user-supplied content, but defenders should not read AV:L as 'requires attacker to already be on the box.' No EPSS score was supplied, so exploitation-probability cannot be quantified from the input. The CVE is not present in CISA KEV, so there is no confirmed active exploitation. No explicit POC flag was provided, though a third-party technical blog (khaelkugler.com) is referenced and may contain exploitation detail - treat exploit availability as unverified, not confirmed. Net: real priority for any title that loads user-generated Blueprint content on Windows (modding/UGC ecosystems), lower priority for engines/games that never ingest third-party Blueprints.

An attacker publishes a malicious mod, map, or other user-generated content pack containing a Blueprint that calls LaunchURL with a file:/// URI (hosted locally or on an attacker-controlled WebDAV share). Because the default URL scheme filter is empty, a Windows victim who loads that content triggers ShellExecuteW with the open verb, executing the referenced file as arbitrary commands. A third-party technical write-up is referenced in the data, but no public exploit is confirmed in the provided intelligence.