Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.4
CVE-2025-59489: Unity Runtime on Android, Windows, macOS, and Linux loads code from wrong place
CVE-2025-59489 · published 1 year ago
Summary
If you use an older version of Unity Runtime on Android, Windows, macOS, or Linux, a hacker could trick it into loading code from somewhere it shouldn't. This could allow them to run malicious code on your machine and steal sensitive information. To fix this, you'll need to rebuild and redeploy any affected applications with the latest, secure version of Unity Runtime.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unity | editor |
>= 2017.4, <= 2018.4 >= 2019.1, < 2019.1.15f1 >= 2019.2, < 2019.2.23f1 >= 2019.3, <= 2019.3.17f1 >= 2019.4, < 2019.4.41f1 >= 2020.1, < 2020.1.18f1 >= 2020.2, < 2020.2.8f1 >= 2020.3, < 2020.3.49f1 >= 2021.1, < 2021.1.29f1 >= 2021.2, < 2021.2.20f1 >= 2021.3, < 2021.3.45f2 >= 2022.1, < 2022.1.25f1 11 more version ranges
cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:* |
Original advisory text
Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built w...
Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the vulnerable Unity Runtime code, then an adversary may be able to execute code on, and exfiltrate confidential information from, the machine on which that application is running. NOTE: product status is provided for Unity Editor because that is the information available from the Supplier. However, updating Unity Editor typically does not address the effects of the vulnerability; instead, it is necessary to rebuild and redeploy all affected applications.
References
- https://flatt.tech/research/posts/arbitrary-code-execution-in-unity-runtime/ Exploit Third Party Advisory
- https://unity.com/security#security-updates-and-patches Product
- https://unity.com/security/sept-2025-01 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CWE-426Untrusted Search Path
Timeline
Published3 Oct 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-59489 · NVD
Track software like this
Free during beta