MECCHA CHAMELEON Flaw Lets Malicious Custom Maps Achieve Remote Code Execution

Aikido Security disclosed a vulnerability in MECCHA CHAMELEON's use of Unreal Engine that allowed malicious Steam Workshop maps to use the FinishRecordingOutput Blueprint node to write arbitrary files (including HTA payloads embedded in PCM WAV data) to user-writable locations such as the Windows Startup folder, producing delayed remote code execution after reboot; the issue was patched in MECCHA CHAMELEON v4.0.0 and researchers found no evidence of active exploitation in existing Workshop maps.