MECCHA CHAMELEON patched delayed RCE via malicious custom maps writing arbitrary files

The vulnerability demonstrates how game modding systems can create unexpected attack surfaces. MECCHA CHAMELEON's implementation of Unreal Engine Blueprints allowed community-created maps to execute code with the same permissions as the game client. This differs from traditional game maps that only contain level geometry and assets, as Blueprints enable actual program logic to be distributed through map files.

The specific attack vector exploited the 'Finish Recording Output' function exposed to Blueprints. This function's ability to write audio files to arbitrary paths - including absolute paths and relative paths traversing directories - created the file write primitive. The security impact was amplified by the game's automatic map download system, which forced players to load untrusted content when joining multiplayer lobbies.

The delayed execution aspect of this vulnerability made it particularly dangerous. By writing executables to startup directories, attackers could maintain persistence across system reboots. This attack pattern bypasses some traditional security controls that focus on immediate code execution, as the malicious payload would only activate after the game session ended and the system restarted.

The patching approach highlights the challenges of securing modding ecosystems. While the specific vulnerability was fixed, the underlying architecture of exposing Blueprint functions to community content remains. Game developers must carefully audit which engine functions are exposed to modding systems, particularly those that interact with the filesystem or operating system. The automatic update mechanism helps ensure players receive fixes, but doesn't address the fundamental design considerations for moddable games.