CVE-2025-59489

Published Oct 3, 2025

Last updated 2 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-59489 is a vulnerability in the Unity Runtime that affects games and applications built on Unity. Discovered on June 4, 2025, the vulnerability exists in Unity versions 2017.1 and later. It stems from the intent handling process, which allows malicious intents to control command line arguments passed to Unity applications. This could allow attackers to load arbitrary shared libraries and execute malicious code. The vulnerability involves an untrusted search path, potentially leading to unsafe file loading and local file inclusion. Exploitation could result in local code execution or information disclosure at the privilege level of the vulnerable application. The vulnerability primarily affects applications running on Android, Windows, Linux, and macOS. Unity has released patches for Unity 2019.1 and later, as well as a Unity Binary Patch tool to address the issue.

Description: Unity Editor 2019.1 through 6000.3 could allow remote attackers to exploit file loading and Local File Inclusion (LFI) mechanisms via a crafted local application because of an Untrusted Search Path. This could permit unauthorized manipulation of runtime resources and third-party integrations. The issue could affect applications built using Unity and deployed across Android, Windows, macOS, and Linux platforms.
Source: cve@mitre.org
NVD status: Received

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.4
Impact score: 5.9
Exploitability score: 2.5
Vector string: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-426

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 41

References