Epic Games Unreal Engine ships with the LaunchURL node configured to accept all URL schemes by default. The URL scheme filter is empty, allowing unfiltered calls to ShellExecuteW with the open verb on Windows. This permits a malicious Blueprint that references a file:// URI or a WebDAV file to execute arbitrary code on the machine that runs the game, leading to full local code execution. The weakness is a classic CWE-1188 scenario where an insecure default configuration is used.

All versions of Epic Games Unreal Engine up to and including 5.8.0 are affected. Games built with these releases that load user‑generated Blueprints or any Blueprint assets are vulnerable. The issue manifests on Windows platforms where ShellExecuteW is invoked.

The CVSS score of 7.7 reflects the severity of the vulnerability, indicating that exploitation could result in arbitrary code execution. The EPSS score of < 1% suggests a low probability of exploitation in the wild. The vulnerability remains significant because the Unreal Engine game loads user‑generated Blueprint content that can reference file:// URLs, allowing a malicious local file or a remote file on a WebDAV share to trigger ShellExecuteW() and execute code. The vulnerability is not currently listed in CISA’s KEV catalog, indicating it has not yet been widely exploited, though the attack vector could be local or remote if user‑generated content is accepted.