CVE-2025-59489

Published Oct 3, 2025

Last updated a month ago

Unity Editor

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-59489 is a vulnerability in the Unity Runtime that affects games and applications built on Unity. Discovered on June 4, 2025, the vulnerability exists in Unity versions 2017.1 and later. It stems from the intent handling process, which allows malicious intents to control command line arguments passed to Unity applications. This could allow attackers to load arbitrary shared libraries and execute malicious code. The vulnerability involves an untrusted search path, potentially leading to unsafe file loading and local file inclusion. Exploitation could result in local code execution or information disclosure at the privilege level of the vulnerable application. The vulnerability primarily affects applications running on Android, Windows, Linux, and macOS. Unity has released patches for Unity 2019.1 and later, as well as a Unity Binary Patch tool to address the issue.

Description: Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the vulnerable Unity Runtime code, then an adversary may be able to execute code on, and exfiltrate confidential information from, the machine on which that application is running. NOTE: product status is provided for Unity Editor because that is the information available from the Supplier. However, updating Unity Editor typically does not address the effects of the vulnerability; instead, it is necessary to rebuild and redeploy all affected applications.
Source: cve@mitre.org
NVD status: Analyzed
Products: editor

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.4
Impact score: 5.9
Exploitability score: 1.4
Vector string: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

cve@mitre.org: CWE-88
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-426

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "21A9623D-D8B1-41C8-838C-3A5D9DC94893",
            "versionEndIncluding": "2018.4",
            "versionStartIncluding": "2017.4"
          },
          {
            "criteria": "cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "80164735-6B7A-4224-9681-0C8EFDACDE91",
            "versionEndExcluding": "2019.1.15f1",
            "versionStartIncluding": "2019.1"
          },
          {
            "criteria": "cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "25B84777-C5E0-48AE-A969-55FD4DB1CC9B",
            "versionEndExcluding": "2019.2.23f1",
            "versionStartIncluding": "2019.2"
          },
          {
            "criteria": "cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1BD52B26-9C04-40BA-9B4C-4703DE47E5D0",
            "versionEndIncluding": "2019.3.17f1",
            "versionStartIncluding": "2019.3"
          },
          {
            "criteria": "cpe:2.3:a:unity:editor:*:*:*:*:lts:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2844E761-7A18-439D-8A4E-EECFEF9A4BF6",
            "versionEndExcluding": "2019.4.41f1",
            "versionStartIncluding": "2019.4"
          },
          {
            "criteria": "cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4437C3BD-AD82-4C71-9D37-35EE28AF4666",
            "versionEndExcluding": "2020.1.18f1",
            "versionStartIncluding": "2020.1"
          },
          {
            "criteria": "cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C0A0F338-39D0-4273-B330-10284BFD4D45",
            "versionEndExcluding": "2020.2.8f1",
            "versionStartIncluding": "2020.2"
          },
          {
            "criteria": "cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1B0EDE20-DEDE-4711-85B4-42222B96A76A",
            "versionEndExcluding": "2020.3.49f1",
            "versionStartIncluding": "2020.3"
          },
          {
            "criteria": "cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7AE6D29B-FBDC-411B-A80C-91906F52B5D5",
            "versionEndExcluding": "2021.1.29f1",
            "versionStartIncluding": "2021.1"
          },
          {
            "criteria": "cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C9DB811C-2F11-460A-84A6-4F8428022B83",
            "versionEndExcluding": "2021.2.20f1",
            "versionStartIncluding": "2021.2"
          },
          {
            "criteria": "cpe:2.3:a:unity:editor:*:*:*:*:lts:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BA441916-E1BB-435A-BF13-E7C881DA753F",
            "versionEndExcluding": "2021.3.45f2",
            "versionStartIncluding": "2021.3"
          },
          {
            "criteria": "cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7F72C377-DBDA-40FA-B21B-7088253021B5",
            "versionEndExcluding": "2022.1.25f1",
            "versionStartIncluding": "2022.1"
          },
          {
            "criteria": "cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E1BE4037-1605-43D5-96C9-F84CDE421096",
            "versionEndExcluding": "2022.2.23f1",
            "versionStartIncluding": "2022.2"
          },
          {
            "criteria": "cpe:2.3:a:unity:editor:*:*:*:*:lts:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "08C455CB-FCD6-4D86-AC8E-2509F0A7EB62",
            "versionEndExcluding": "2022.3.62f2",
            "versionStartIncluding": "2022.3"
          },
          {
            "criteria": "cpe:2.3:a:unity:editor:*:*:*:*:lts:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "565D184B-47D1-4CD7-AD7C-887FCF304DC1",
            "versionEndExcluding": "2023.1.22f1",
            "versionStartIncluding": "2023.1"
          },
          {
            "criteria": "cpe:2.3:a:unity:editor:*:*:*:*:lts:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A51D8CF4-3E6D-45D2-92CB-819095A5C647",
            "versionEndExcluding": "2023.2.22f1",
            "versionStartIncluding": "2023.2"
          },
          {
            "criteria": "cpe:2.3:a:unity:editor:*:*:*:*:lts:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D643C324-981A-4CC1-B157-31C46879B0D7",
            "versionEndExcluding": "6000.0.58f2",
            "versionStartIncluding": "6000.0"
          },
          {
            "criteria": "cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7CFEF658-7CFF-429E-94BC-501D09A0214B",
            "versionEndExcluding": "6000.1.17f1",
            "versionStartIncluding": "6000.1"
          },
          {
            "criteria": "cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CC4F84C7-9076-4525-ADF5-0C47A199FB92",
            "versionEndExcluding": "6000.2.6f2",
            "versionStartIncluding": "6000.2"
          },
          {
            "criteria": "cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8B7A8BC7-437E-4090-B951-400BB396A121",
            "versionEndExcluding": "6000.3.0b4",
            "versionStartIncluding": "6000.3"
          },
          {
            "criteria": "cpe:2.3:a:unity:editor:2017.1.2p4\\+:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4D4B42AC-5124-4DC9-9868-790314FB92FE"
          },
          {
            "criteria": "cpe:2.3:a:unity:editor:2017.2.0p4\\+:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "73D7C1E8-3FCC-4F23-A906-ADAF18DF47E4"
          },
          {
            "criteria": "cpe:2.3:a:unity:editor:2017.3.0b9\\+:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C9CBFCEC-8196-4423-878C-C3B8844375D7"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"
          },
          {
            "criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]

References

Sources include official advisories and independent security research.