Strix
26.1K

CVE-2025-59489

HIGHCVSS 7.4/10EPSS 0.59%

Last modified

CVE-2025-59489 is a high-severity vulnerability rated 7.4/10 on the CVSS scale. Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the vulnerable Unity Runtime code, then an adversary may be able to execute code on, and exfiltrate confidential information from, the machine on which that application is running. EPSS estimates a 0.59% chance of exploitation in the next 30 days.

Description

Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the vulnerable Unity Runtime code, then an adversary may be able to execute code on, and exfiltrate confidential information from, the machine on which that application is running. NOTE: product status is provided for Unity Editor because that is the information available from the Supplier. However, updating Unity Editor typically does not address the effects of the vulnerability; instead, it is necessary to rebuild and redeploy all affected applications.

Metrics

CVSS 3.1
7.4/10

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.59%

43.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
UnityEditor>= 2017.4, <= 2018.4
UnityEditor>= 2019.1, < 2019.1.15f1
UnityEditor>= 2019.2, < 2019.2.23f1
UnityEditor>= 2019.3, <= 2019.3.17f1
UnityEditor>= 2019.4, < 2019.4.41f1
UnityEditor>= 2020.1, < 2020.1.18f1
UnityEditor>= 2020.2, < 2020.2.8f1
UnityEditor>= 2020.3, < 2020.3.49f1
UnityEditor>= 2021.1, < 2021.1.29f1
UnityEditor>= 2021.2, < 2021.2.20f1
UnityEditor>= 2021.3, < 2021.3.45f2
UnityEditor>= 2022.1, < 2022.1.25f1
UnityEditor>= 2022.2, < 2022.2.23f1
UnityEditor>= 2022.3, < 2022.3.62f2
UnityEditor>= 2023.1, < 2023.1.22f1
UnityEditor>= 2023.2, < 2023.2.22f1
UnityEditor>= 6000.0, < 6000.0.58f2
UnityEditor>= 6000.1, < 6000.1.17f1
UnityEditor>= 6000.2, < 6000.2.6f2
UnityEditor>= 6000.3, < 6000.3.0b4
UnityEditor2017.1.2p4\+
UnityEditor2017.2.0p4\+
UnityEditor2017.3.0b9\+

References

Timeline

Published
Last Modified
Status
Analyzed

Frequently Asked Questions

What is CVE-2025-59489?
Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the vulnerable Unity Runtime code, then an adversary may be able to execute code on, and exfiltrate confidential information from, the machine on which that application is running. NOTE: product status is provided for Unity Editor because that is the information available from the Supplier. However, updating Unity Editor typically does not address the effects of the vulnerability; instead, it is necessary to rebuild and redeploy all affected applications.
How severe is CVE-2025-59489?
CVE-2025-59489 has a CVSS score of 7.4/10 (HIGH severity). The EPSS model estimates a 0.59% probability of exploitation in the next 30 days.
How do I fix CVE-2025-59489?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2025-59489?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST