CVE-2026-14765: CWE-1188 Initialization of a Resource with an Insecure Default in Epic Games Unreal Engine

CVE-2026-14765 affects Unreal Engine versions up to 5.8.0 due to an insecure default initialization of the URL scheme filter in the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL). The filter (FURLRequestFilter) is empty by default, permitting all URL schemes. On Windows platforms, this results in calls to ShellExecuteW() with the 'open' verb, allowing a file:/// URI to execute the referenced file. Consequently, any Unreal Engine game that loads user-generated content with Blueprints is vulnerable to command execution via malicious local or remote files, such as those hosted on a WebDAV share. This is an instance of CWE-1188, indicating initialization of a resource with an insecure default.

The vulnerability allows an attacker to execute arbitrary commands on the victim's system by supplying malicious user-generated content that exploits the insecure default URL scheme filter. This can lead to full compromise of the affected system's confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.7 (high), reflecting local attack vector, high attack complexity, no privileges required, user interaction required, scope change, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, developers and users should avoid loading untrusted user-generated content containing Blueprints that use the LaunchURL node. Consider implementing custom URL scheme filters to restrict allowed schemes and reduce risk.