MECCHA CHAMELEON can't hide from the RCE

What it is

A second delayed-RCE vulnerability in MECCHA CHAMELEON (built on Unreal Engine 5.6.1), distinct from a previously patched map-load RCE. It abuses the Blueprint-exposed native function Finish Recording Output to write arbitrary files anywhere on a victim's filesystem when they load an attacker-supplied Steam Workshop map. Fixed in version 4.0.0.

How it works

MECCHA CHAMELEON maps aren't just assets — they can contain Blueprint graphs that run inside the game process on map load, executing any native function exposed to Blueprint with the player's permissions. The researcher enumerated exposed functions by right-clicking a Blueprint graph and searching for save, export, write, record, open, launch, load, then found Finish Recording Output, which writes an audio file to a caller-supplied path.

The path accepts absolute or relative values. The default output directory is C:\Users\<user>\AppData\Local\Chameleon\Saved\BouncedWavFiles, so a relative payload prefixed with ../../../../../ reaches the user's home folder without needing to know the username. Targeting the Startup folder yields code execution on next boot. Unreal forcibly appends .wav to the supplied name; the page describes bypassing this via a null byte (U+0000) — Unreal sees one string and appends .wav, while lower-level Windows APIs treat the null as a terminator and discard everything after it, so the file lands as .exe. (The fetched text cuts off mid-sentence before the completed null-byte exploit; the null-byte mechanism itself is stated.)

Preconditions / Affected

• MECCHA CHAMELEON prior to 4.0.0, on Windows.
• Victim loads an attacker-controlled community map — notably, a lobby host can prompt every other player to download and load their map, and the UI pressures players who haven't downloaded yet.
• RCE is delayed: the dropped executable runs on the next system restart, not immediately.

What to do

• Ensure the game is on 4.0.0 or later. Per the page, this update installs automatically before the game launches, so most players are covered without manual action — but verify.
• If investigating a suspected pre-patch compromise, inspect the Startup folder (...\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup) and look for unexpected files written via the BouncedWavFiles traversal path.

Caveats

• The vendor fix is applied; no bypass of 4.0.0 is claimed.
• The exploit is a client-side risk of playing untrusted community maps — the concrete take-home is that Unreal Blueprints in downloaded maps run with the game's OS permissions, not that the game itself is broadly exploitable.