A now-patched vulnerability in the popular online hide-and-seek game MECCHA CHAMELEON allowed malicious Steam Workshop maps to plant files on a player’s Windows system and achieve delayed remote code execution after a restart.
Security researcher Robbe Van Roey disclosed the issue on September 3, warning that the game’s custom-map functionality exposed a dangerous Unreal Engine audio-recording capability to Blueprint scripts.
The game’s developers addressed the vulnerability in MECCHA CHAMELEON version 4.0.0, released on August 20. The update is installed automatically before the game launches.
MECCHA CHAMELEON Flaw
MECCHA CHAMELEON relies heavily on community-created maps distributed through the Steam Workshop. In multiplayer lobbies, the host chooses a map, and other participants are prompted to download it before joining the match.
Unlike conventional game maps that primarily contain models, textures, and level layouts, MECCHA CHAMELEON maps can include Unreal Engine Blueprints. These visual scripts execute within the game process and can invoke native functions deliberately exposed by developers.
That design created a high-risk attack surface: an attacker could upload a weaponized map, host a lobby, and entice players to download and load it. Once launched, the malicious Blueprint logic would run with the affected player’s permissions.
The finding followed an earlier map-load RCE issue reported in the game. Although the previous flaw had been patched, Van Roey’s research showed that another route to code execution remained available.
Robbe Van Roey identified Unreal Engine’s Finish Recording Output functionality as the key issue. The audio-recording feature was exposed to Blueprints and accepted an output path and filename when saving recorded sound data.
A malicious map could begin a recording, play controlled audio, and stop the recording while specifying an attacker-controlled destination. By abusing path traversal behavior, the map could escape the game’s normal audio-output directory and write files into user-controlled Windows locations.
Initially, Unreal Engine appended a .wav extension to recorded files, preventing an attacker from simply dropping a conventional executable.
However, Robbe Van Roey found a discrepancy between Unreal’s filename handling and lower-level Windows APIs. By exploiting differences in null-byte processing, the malicious Blueprint could cause Windows to treat the output as a file with an attacker-selected extension.
The remaining challenge was converting an audio file into something Windows could execute. The proof of concept used uncompressed PCM audio, in which individual sample values directly control the underlying bytes written to disk.
Because an executable typically requires a valid header at the beginning of the file, the researcher chose the Windows HTML Application (HTA) format.
HTA files are processed by mshta.exe and can execute JScript or VBScript with desktop application privileges rather than the normal browser sandbox restrictions.
The crafted audio file retained a legitimate WAV header but embedded HTML and script content within its PCM sample data. When written with an HTA-compatible extension and later launched through a startup mechanism, Windows ignored the leading WAV metadata and processed the embedded script.
The complete exploit executed when a malicious level loaded, writing the payload to a Windows startup location so that the code would run after the victim restarted their system.
Van Roey said the patched StopRecordingOutput function no longer creates files, including legitimate recordings. The researcher also reviewed Steam Workshop maps and found no evidence of active exploitation.
The issue was reported after several attempts to contact beginning August 11. MECCHA CHAMELEON’s developer responded on August 17 and released the security fix three days later.
Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN
