Unreal Engine
Monthly
Code execution is possible in Epic Games Unreal Engine builds up to and including 5.8.0 on Windows because the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL) ships with an empty FURLRequestFilter, allowing every URL scheme - including file:/// - to pass through to ShellExecuteW() with the open verb, which executes the referenced file. The issue is reachable only in titles that ingest user-generated content containing Blueprints: the attacker must supply a malicious file locally or via a WebDAV share and the victim must load or interact with that content (unauthenticated remote/local attacker, CVSS 3.1 base 7.7, AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). No public exploit code has been identified at time of analysis; real-world risk is conditionally gated by the Windows-only dependency, the requirement that a game actually loads third-party Blueprints, mandatory user interaction, and high attack complexity.
Code execution is possible in Epic Games Unreal Engine builds up to and including 5.8.0 on Windows because the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL) ships with an empty FURLRequestFilter, allowing every URL scheme - including file:/// - to pass through to ShellExecuteW() with the open verb, which executes the referenced file. The issue is reachable only in titles that ingest user-generated content containing Blueprints: the attacker must supply a malicious file locally or via a WebDAV share and the victim must load or interact with that content (unauthenticated remote/local attacker, CVSS 3.1 base 7.7, AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). No public exploit code has been identified at time of analysis; real-world risk is conditionally gated by the Windows-only dependency, the requirement that a game actually loads third-party Blueprints, mandatory user interaction, and high attack complexity.