MECCHA CHAMELEON can't hide from the RCE

A researcher discovered a remote code execution vulnerability in MECCHA CHAMELEON caused by an exposed Unreal Engine Blueprint API that allowed attacker-controlled maps to write files anywhere on a victim's system. By recording crafted uncompressed PCM audio (containing an HTA payload) and using path traversal plus a null-byte truncation trick, the map could create a malicious .hta file in the user's Startup folder, resulting in code execution on reboot. The issue was privately disclosed and patched in version 4.0.0; no in-the-wild exploitation was found.