Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the vulnerable Unity Runtime code, then an adversary may be able to execute code on, and exfiltrate confidential information from, the machine on which that application is running. NOTE: product status is provided for Unity Editor because that is the information available from the Supplier. However, updating Unity Editor typically does not address the effects of the vulnerability; instead, it is necessary to rebuild and redeploy all affected applications.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Apple
  • Macos
Google
  • Android
Linux
  • Linux
  • Linux Kernel
Microsoft
  • Windows
Unity
  • Editor
Unity3d
  • Unity Editor

Configuration 1 [-]

AND
OR cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*
cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*
cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*
cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*
cpe:2.3:a:unity:editor:*:*:*:*:lts:*:*:*
cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*
cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*
cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*
cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*
cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*
cpe:2.3:a:unity:editor:*:*:*:*:lts:*:*:*
cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*
cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*
cpe:2.3:a:unity:editor:*:*:*:*:lts:*:*:*
cpe:2.3:a:unity:editor:*:*:*:*:lts:*:*:*
cpe:2.3:a:unity:editor:*:*:*:*:lts:*:*:*
cpe:2.3:a:unity:editor:*:*:*:*:lts:*:*:*
cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*
cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*
cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*
cpe:2.3:a:unity:editor:2017.1.2p4\+:*:*:*:-:*:*:*
cpe:2.3:a:unity:editor:2017.2.0p4\+:*:*:*:-:*:*:*
cpe:2.3:a:unity:editor:2017.3.0b9\+:*:*:*:-:*:*:*
OR cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

No data.

References
Link Providers
https://flatt.tech/research/posts/arbitrary-code-execution-in-unity-runtime/ cve-icon cve-icon
https://unity.com/security#security-updates-and-patches cve-icon cve-icon
https://unity.com/security/sept-2025-01 cve-icon cve-icon
History

Wed, 22 Oct 2025 18:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google android
Linux linux Kernel
Unity
Unity editor
CPEs cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*
cpe:2.3:a:unity:editor:*:*:*:*:lts:*:*:*
cpe:2.3:a:unity:editor:2017.1.2p4\+:*:*:*:-:*:*:*
cpe:2.3:a:unity:editor:2017.2.0p4\+:*:*:*:-:*:*:*
cpe:2.3:a:unity:editor:2017.3.0b9\+:*:*:*:-:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Google
Google android
Linux linux Kernel
Unity
Unity editor

Mon, 06 Oct 2025 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux
Microsoft
Microsoft windows
Unity3d
Unity3d unity Editor
Vendors & Products Apple
Apple macos
Linux
Linux linux
Microsoft
Microsoft windows
Unity3d
Unity3d unity Editor

Fri, 03 Oct 2025 17:30:00 +0000

Type Values Removed Values Added
Description Unity Editor 2019.1 through 6000.3 could allow remote attackers to exploit file loading and Local File Inclusion (LFI) mechanisms via a crafted local application because of an Untrusted Search Path. This could permit unauthorized manipulation of runtime resources and third-party integrations. The issue could affect applications built using Unity and deployed across Android, Windows, macOS, and Linux platforms. Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the vulnerable Unity Runtime code, then an adversary may be able to execute code on, and exfiltrate confidential information from, the machine on which that application is running. NOTE: product status is provided for Unity Editor because that is the information available from the Supplier. However, updating Unity Editor typically does not address the effects of the vulnerability; instead, it is necessary to rebuild and redeploy all affected applications.
Weaknesses CWE-88
Metrics cvssV3_1

{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Fri, 03 Oct 2025 14:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-426
Metrics cvssV3_1

{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 03 Oct 2025 13:45:00 +0000

Type Values Removed Values Added
Description Unity Editor 2019.1 through 6000.3 could allow remote attackers to exploit file loading and Local File Inclusion (LFI) mechanisms via a crafted local application because of an Untrusted Search Path. This could permit unauthorized manipulation of runtime resources and third-party integrations. The issue could affect applications built using Unity and deployed across Android, Windows, macOS, and Linux platforms.
References
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2025-10-03T00:00:00.000Z

Updated: 2025-10-03T17:22:11.001Z

Reserved: 2025-09-16T00:00:00.000Z

Link: CVE-2025-59489

cve-icon Vulnrichment

Updated: 2025-10-03T13:55:43.155Z

cve-icon NVD

Status : Analyzed

Published: 2025-10-03T14:15:45.733

Modified: 2025-10-22T18:12:25.693

Link: CVE-2025-59489

cve-icon Redhat

No data.