Description

Summary:

Confirmed that this exists in latest as well as 5.8 which is the origin or both tickets. This is a regression from 5.7 - although it looks like the guard was not aiming specifically to catch that.

  • 5.6 / 5.7 — a plain two-line accessor. It returns the reinterpreted bytes, and GetBoneName null-checks the result (SkinnedMeshComponent.cpp:2241), so garbage-reading-null yields NAME_None. The bug is exercised on every overlap and stays latent.
  • 5.8 / FN Main — gained a KnownSkinnedAsset cache-validation block under #if WITH_EDITOR. When the two disagree it calls OutdatedKnownSkinnedAssetDetected(), whose ensureMsgf message arguments dereference the garbage via GetFullName(). That
    dereference has no null-check equivalent, so the latent bad cast becomes a hard crash.

UCharacterMovementComponent::CapsuleTouched casts the overlapped component to USkinnedMeshComponent* with a C-style cast, guarded only by OtherBodyIndex != INDEX_NONE.

Engine/Source/Runtime/Engine/Private/Components/CharacterMovementComponent.cpp:11693

if (OtherComp != NULL && OtherComp->IsAnySimulatingPhysics())
{
    ...
    FName BoneName = NAME_None;
    if (OtherBodyIndex != INDEX_NONE)
    {
        BoneName = ((USkinnedMeshComponent*)OtherComp)->GetBoneName(OtherBodyIndex);   // line 11713
    }

A UGeometryCollectionComponent is not a USkinnedMeshComponent, but it satisfies both guards: it reports IsAnySimulatingPhysics() == true while simulating, and it delivers a per-particle OtherBodyIndex >= 0 rather than INDEX_NONE. The cast is therefore taken on an unrelated type and GetBoneName reads through a garbage SkinnedAsset pointer.

OtherBodyIndex is only meaningful as a bone index for skinned meshes. For a geometry collection it is a particle/transform index and should not be passed to GetBoneName at all.

Call stack:

Unhandled Exception: EXCEPTION_ACCESS_VIOLATION reading address 0x0000000000000012

UCharacterMovementComponent::CapsuleTouched()               CharacterMovementComponent.cpp:11713
USkinnedMeshComponent::GetBoneName()                        SkinnedMeshComponent.cpp:2542
USkinnedMeshComponent::GetSkinnedAsset()                    SkinnedMeshComponent.cpp:2882
USkinnedMeshComponent::OutdatedKnownSkinnedAssetDetected()  SkinnedMeshComponent.cpp:6119
UObjectBaseUtility::GetFullName()                           UObjectBaseUtility.cpp:117

Reached through the ordinary movement path:

UCharacterMovementComponent::TickComponent()
UCharacterMovementComponent::ControlledCharacterMove()
UCharacterMovementComponent::PerformMovement()
FScopedMovementUpdate::~FScopedMovementUpdate()
USceneComponent::UpdateOverlaps()
UPrimitiveComponent::BeginComponentOverlap()
UCharacterMovementComponent::CapsuleTouched()

Have Comments or More Details?

There's no existing public thread on this issue, so head over to Questions & Answers just mention UE-392989 in the post.

0
Login to Vote

Unresolved
ComponentUE - Runtime - Character
Affects Versions5.8
CreatedAug 21, 2026
UpdatedAug 21, 2026
View Jira Issue