Unreal Engine

Vendor:

First CVE: Dec 31, 2003 · Active for 22 years

11

Total CVEs

More Total CVEs than 88% of tracked products

2.2

Avg CVEs / Year

Higher CVE frequency than 78% of tracked products

6.8

Avg CVSS

Higher Avg CVSS than 29% of tracked products

0.0%

KEV Rate

Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Unreal Engine over time

Volume of CVEsAvg CVSS Base Score

First CVE

Dec 31, 2003

22 years ago

Most Recent CVE

Jul 12, 2010

5,860 days ago

CVE Severity & Scoring

Unreal Engine11 CVEs

55%

45%

All CVEs353,173 CVEs

45%

40%

11%

MediumHigh

Attack Vector

Local0 (0.0%)

Network0 (0.0%)

Unknown11 (100.0%)

Physical0 (0.0%)

Adjacent Network0 (0.0%)

Attack Complexity

Low0 (0.0%)

High0 (0.0%)

Unknown11 (100.0%)

User Interaction

None0 (0.0%)

Unknown11 (100.0%)

Required0 (0.0%)

Privileges Required

Low0 (0.0%)

High0 (0.0%)

None0 (0.0%)

Unknown11 (100.0%)

Top CVEs

Signals from CVEs in this product scope (11 CVEs).

11 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2004-0608HIGH The Unreal Engine, as used in DeusEx 1.112fm and earlier, Devastation 390 and earlier, Mobile Forces 20000 and earlier, Nerf Arena Blast 1.2 and earlier, Postal 2 1337 and earlier,	Dec 6, 2004	10.0	81	NO	YES
CVE-2003-1431HIGH Buffer overflow in Epic Games Unreal Engine 226f through 436 allows remote attackers to cause a denial of service (crash) via a long host string in the Unreal URL.	Dec 31, 2003	7.1	35	NO	YES
CVE-2003-1432HIGH Epic Games Unreal Engine 226f through 436 allows remote attackers to cause a denial of service (CPU consumption or crash) and possibly execute arbitrary code via (1) a packet with	Dec 31, 2003	10.0	33	NO	NO
CVE-2010-2702HIGH Buffer overflow in the UGameEngine::UpdateConnectingMessage function in the Unreal engine 1, 2, and 2.5, as used in multiple games including Unreal Tournament 2004, Unreal tourname	Jul 12, 2010	9.3	28	NO	NO
CVE-2003-1430MEDIUM Directory traversal vulnerability in Unreal Tournament Server 436 and earlier allows remote attackers to access known files via a ".." (dot dot) in an unreal:// URL.	Dec 31, 2003	5.0	28	NO	YES
CVE-2004-1805MEDIUM Format string vulnerability in games using the Epic Games Unreal Engine 436 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via for	Dec 31, 2004	5.0	25	NO	YES
CVE-2008-6441HIGH Format string vulnerability in the Epic Games Unreal engine client, as used in multiple games, allows remote servers to execute arbitrary code via (1) the CLASS parameter in a DLMG	Mar 9, 2009	9.3	24	NO	NO
CVE-2007-4442MEDIUM Stack-based buffer overflow in the logging function in the Unreal engine, possibly 2003 and 2004, as used in the internal web server, allows remote attackers to cause a denial of s	Aug 21, 2007	5.0	23	NO	YES
CVE-2004-1958MEDIUM Directory traversal vulnerability in manifest.ini in Unreal engine allows remote attackers to overwrite arbitrary files via .. (dot dot) sequences in a UMOD (Unreal MOD) file.	Dec 31, 2004	5.0	23	NO	YES
CVE-2003-1433MEDIUM Epic Games Unreal Engine 226f through 436 does not validate the challenge key, which allows remote attackers to exhaust the player limit by joining the game multiple times.	Dec 31, 2003	4.3	18	NO	NO

View all 11 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (11 CVEs).

CISA KEV

0 CVEs

0.0% of CVEs· Bottom 1%

Metasploit

1 CVE

9.1% of CVEs· 97th percentile

Nuclei

0 CVEs

0.0% of CVEs· Bottom 1%

ExploitDB

6 CVEs

54.5% of CVEs· 91st percentile

Social Chatter

Signals from CVEs in this product scope (11 CVEs).

Media Mentions

Signals from CVEs in this product scope (11 CVEs).

Top CNAs Publishing CVEs For Unreal Engine

Top CWEs

Versions

Version	CVE Count	Avg CVSS	Avg EPSS	Exploits
436	7	6.6	14.2%	5
433	7	6.6	14.2%	5
3	1	9.3	3.5%	0
2.5	2	9.3	4.2%	0
226f	6	6.9	16.1%	4
2004	2	5.0	2.8%	1
2003	2	5.0	2.8%	1
2	2	9.3	4.2%	0
1	1	9.3	4.9%	0