CVE-2025-59489

HIGH EPSS 43.9%

Published Oct 3, 20259mo ago · Modified Jun 17, 20262w ago

7.4 CVSS 3.1

High

Published Oct 3, 2025 9mo ago

Last Modified Jun 17, 2026 2w ago

Description

Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the vulnerable Unity Runtime code, then an adversary may be able to execute code on, and exfiltrate confidential information from, the machine on which that application is running. NOTE: product status is provided for Unity Editor because that is the information available from the Supplier. However, updating Unity Editor typically does not address the effects of the vulnerability; instead, it is necessary to rebuild and redeploy all affected applications.

CVSS Details

Base Score

7.4

Exploitability

1.4

Impact

5.9

Vector string

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector Local

Attack Complexity High

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

43.9% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 2

CWE-426

CWE-88

Affected Products 27

Vendor	Product	Version	Range
unity	editor	*	≥2017.4 – ≤2018.4
unity	editor	*	≥2019.1 – <2019.1.15f1
unity	editor	*	≥2019.2 – <2019.2.23f1
unity	editor	*	≥2019.3 – ≤2019.3.17f1
unity	editor	*	≥2019.4 – <2019.4.41f1
unity	editor	*	≥2020.1 – <2020.1.18f1
unity	editor	*	≥2020.2 – <2020.2.8f1
unity	editor	*	≥2020.3 – <2020.3.49f1
unity	editor	*	≥2021.1 – <2021.1.29f1
unity	editor	*	≥2021.2 – <2021.2.20f1
unity	editor	*	≥2021.3 – <2021.3.45f2
unity	editor	*	≥2022.1 – <2022.1.25f1
unity	editor	*	≥2022.2 – <2022.2.23f1
unity	editor	*	≥2022.3 – <2022.3.62f2
unity	editor	*	≥2023.1 – <2023.1.22f1
unity	editor	*	≥2023.2 – <2023.2.22f1
unity	editor	*	≥6000.0 – <6000.0.58f2
unity	editor	*	≥6000.1 – <6000.1.17f1
unity	editor	*	≥6000.2 – <6000.2.6f2
unity	editor	*	≥6000.3 – <6000.3.0b4
unity	editor	2017.1.2p4\+	any
unity	editor	2017.2.0p4\+	any
unity	editor	2017.3.0b9\+	any
apple	macos	*	any
google	android	*	any
linux	linux_kernel	*	any
microsoft	windows	*	any

References 3

flatt.tech https://flatt.tech/research/posts/arbitrary-code-execution-in-unity-runtime/

ExploitThird Party Advisory
unity.com https://unity.com/security#security-updates-and-patches

Product
unity.com https://unity.com/security/sept-2025-01

Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.