CVE-2025-59489Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location.
Updated under an hour ago ()
Does this affect you?
It affects unity editor. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the vulnerable Unity Runtime code, then an adversary may be able to execute code on, and exfiltrate confidential information from, the machine on which that application is running. NOTE: product status is provided for Unity Editor because that is the information available from the Supplier. However, updating Unity Editor typically does not address the effects of the vulnerability; instead, it is necessary to rebuild and redeploy all affected applications.
- CVSS
- 7.4 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-88, CWE-426
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Analyzed
- Record last updated
- Oct 8, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
unity editor unity:editor | from 2017.4 through 2018.4; from 2019.1 before 2019.1.15f1; from 2019.2 before 2019.2.23f1; from 2019.3 through 2019.3.17f1; from 2019.4 before 2019.4.41f1; from 2020.1 before 2020.1.18f1; from 2020.2 before 2020.2.8f1; from 2020.3 before 2020.3.49f1; and 15 more ranges | NVD |
References
- https://flatt.tech/research/posts/arbitrary-code-execution-in-unity-runtime/exploit, third-party-advisory
- https://unity.com/security#security-updates-and-patchesproduct
- https://unity.com/security/sept-2025-01vendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.