CVE-2026-14765

What it is

Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL). The URL scheme filter (FURLRequestFilter) is empty by default, which permits all URL schemes. On Windows, this results in a call to ShellExecuteW() with the open verb, so a supplied file:/// URI causes the referenced file to be executed. Any Unreal Engine game that loads user-generated content containing Blueprints is vulnerable to command execution via a malicious local file or a remote file on a WebDAV share. This is an instance of CWE-1188 (Initialization of a Resource with an Insecure Default).

At a glance

Exploitability

Can be exploited locally on the machine without logging in, but needs a user to act. High risk of data exposure, data tampering, service disruption.

Exploit odds

0.4% chance of exploitation in the next 30 days (EPSS).

Fix

No patch or advisory is linked yet. Look at mitigations or restrict exposure.

Timeline

1. 2026-07-04 17:45 UTC ReservedThe CVE id was reserved by its CNA
2. 2026-10-14 03:17 UTC PublishedDisclosed publicly on CVE.org and NVD
3. 2026-10-18 14:16 UTC Last updatedMost recent change to the record

Details

Published

2026-10-14 03:17 UTC

Last modified

2026-10-18 14:16 UTC

Exploit probability

0.4% · EPSS, next 30 days

Weakness

CWE-1188

Record status

Deferred

Attack profile CVSS 3.1 · 7.7

Attack vector

Local

Complexity

High

Privileges needed

None

User interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High