The security boundary in this bug is an engine annotation. A native function is either exposed to Blueprint or it is not, and once it is exposed, any graph in any downloaded map can call it inside the game process, with the player's account and permissions [7]. Finding the reachable set took no reverse engineering. Aikido opened a Blueprint graph, right-clicked, and searched the node menu for save, export, write, record, open, launch and load [9].
That pass surfaced Finish Recording Output, an audio function that takes a filename and a directory and accepts either an absolute or a relative path [10]. Driving it from a map is three nodes: start a recording, play a sound, stop the recording, then supply the name and path [11]. The default write location is the game's BouncedWavFiles folder under AppData, and a path prefixed with ../../../../../ climbs out of it into the user's home directory without the attacker ever learning the username, while C:/Users/Public/ works as a plain absolute target [12]. No step asks for elevation; the write lands as the player [7].
Two limits in the writeup as published. It names no CVE for the file-write issue [15]. And the text stops once arbitrary file write is established, so the artifact that turns a file on disk into execution after a restart is asserted rather than demonstrated [1][16]. Aikido reports no exploitation in the wild [17].
The delivery path carries the weight. The game built on Unreal Engine 5.6.1 sold 15 million copies in its first month [6][3], an average near 500,000 copies a day across those 30 days [14]. Every one of those installs can be prompted, by a stranger hosting a lobby, to fetch a map whose graphs run locally.
There are now two published code-execution routes through the same map pipeline [13]. The engine's Blueprint-exposed surface was scoped for content authors a developer trusts, and the Workshop hands that same surface to authors nobody vetted [7][4] -- an inventory problem, not a coding bug. Aikido's method was one keyword pass over one right-click menu, and the other functions matching those seven words have not been ruled out in public [9].
