CVE-2026-56137: RPG MAKER MV/MZ RCE Vulnerability

CVE-2026-56137 Overview

CVE-2026-56137 is an OS command injection vulnerability [CWE-78] affecting RPG MAKER MV and RPG MAKER MZ, game development software published by Gotcha Gotcha Games Inc. The flaw allows attackers to execute arbitrary operating system commands when a user loads a specially crafted save-file within the affected editor.

The vulnerability requires local access and user interaction, since a victim must open the malicious save-file. Successful exploitation grants the attacker code execution in the context of the local user, threatening confidentiality, integrity, and availability of the host.

Critical Impact
Loading a malicious RPG MAKER save-file executes attacker-controlled OS commands on the victim's machine, enabling full local compromise of the user account.

Affected Products

RPG MAKER MV (Gotcha Gotcha Games Inc.)
RPG MAKER MZ (Gotcha Gotcha Games Inc.)
Games and projects distributing crafted save-files to end users

Discovery Timeline

2026-06-30 - CVE CVE-2026-56137 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-56137

Vulnerability Analysis

The issue is classified as OS Command Injection [CWE-78]. RPG MAKER MV and MZ process save-file content that is passed, without sufficient sanitization, into an operating system command execution path. An attacker who controls the contents of a save-file can inject shell metacharacters or command arguments that the underlying interpreter then executes.

Exploitation is local and requires user interaction. The victim must load a crafted save-file inside the affected RPG MAKER application. Once loaded, the injected commands run with the privileges of the current user. This creates a realistic distribution path through community game projects, forum downloads, and shared save-files.

The EPSS probability is 0.677% with a percentile of 47.7, reflecting limited public exploitation signal at publication time. No public proof-of-concept, exploit tooling, or CISA KEV listing is associated with this CVE.

Root Cause

The root cause is missing or insufficient neutralization of special elements used in an OS command. Data deserialized from a save-file is concatenated into a command string or arguments that reach a system shell or process spawn API without escaping. Attackers embed shell operators or additional arguments in fields that the editor consumes during load.

Attack Vector

The attack vector is local with required user interaction. An attacker crafts a malicious .rpgsave or project save artifact and delivers it through game distribution channels, chat, email, or file sharing. When the user opens the file in RPG MAKER MV or MZ, the embedded payload triggers arbitrary command execution.

No verified public exploit code exists. See the JVN Security Advisory JVN69681784 and RPG Maker Official News Update for vendor technical details.

Detection Methods for CVE-2026-56137

Indicators of Compromise

Unexpected child processes spawned by RPG MAKER MV or MZ editor executables, particularly cmd.exe, powershell.exe, /bin/sh, or bash.
Save-files (.rpgsave, .rmmzsave, project JSON) containing shell metacharacters such as ;, &&, |, backticks, or $() inside string fields.
Outbound network connections initiated shortly after opening a save-file in an RPG MAKER process.
New scheduled tasks, autorun entries, or dropped executables created by the RPG MAKER process tree.

Detection Strategies

Hunt for parent-child process anomalies where RPG MAKER binaries spawn shell interpreters or scripting hosts.
Inspect recently opened save-files for unusual characters in text fields that would normally hold game data.
Correlate file-open telemetry against process creation events within a short time window on developer workstations.

Monitoring Recommendations

Monitor developer and gamer endpoints for execution of RPG MAKER MV and MZ alongside script interpreter invocations.
Log and alert on user-initiated opening of save-files sourced from untrusted origins or downloads folders.
Track file writes, registry modifications, and network egress originating from RPG MAKER process trees.

How to Mitigate CVE-2026-56137

Immediate Actions Required

Avoid loading save-files received from untrusted sources or unknown community distributions until patches are applied.
Update RPG MAKER MV and MZ installations to the latest version published by Gotcha Gotcha Games as soon as fixes are available.
Advise end users of published games built on affected engines to only accept save-files from the original developer.

Patch Information

Refer to the vendor for fixed builds and update instructions. See the RPG Maker Official News Update and the RPG Maker News Announcement for release details, and the coordinated JVN Security Advisory JVN69681784 for cross-referenced fix information.

Workarounds

Restrict use of the affected editors to save-files created locally or from trusted colleagues.
Run RPG MAKER MV and MZ under a standard, non-administrative user account to limit the impact of command execution.
Isolate development machines that must process untrusted save-files inside a virtual machine or sandbox with no sensitive credentials.

bash

# Configuration example
# Optional AppLocker-style guidance: block shell spawns from RPG MAKER on Windows
# Review vendor advisory before deploying any restriction policy
# https://jvn.jp/en/jp/JVN69681784/