Unity Security Update Advisory (CVE-2025-59489)

Summary
Applications that were built using affected versions of the Unity Editor are susceptible to an unsafe file loading and local file inclusion attack depending on the operating system, which could enable local code execution or information disclosure at the privilege level of the vulnerable application. There is no evidence of any exploitation of the vulnerability nor has there been any impact on users or customers. Unity has provided fixes that address the vulnerability and they are already available to all developers.

Vulnerability Details
CVE ID: CVE-2025-59489
Date Discovered: June 4, 2025
Discovered By: RyotaK of GMO Flatt Security Inc.
Date Patch Available: October 2, 2025
Affected Operating System: See Affected Operating Systems Table
Affected Versions: See Unity Editor Versions Table
Patched Versions: See Unity Editor Versions Table
Vulnerability Type: CWE-426: Untrusted Search Path
Severity: High
CVSS Score: 8.4
CVSS Vector String: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation Potential
Could allow local code execution and access to confidential information on end user devices running unity-built applications. Code execution would be confined to the privilege level of the vulnerable application, and information disclosure would be confined to the information available to the vulnerable application.There is no evidence of any exploitation of the vulnerability nor has there been any impact on users or customers.

Unity Editor Versions
Applications built with the indicated versions of the Unity Editor prior to the Patched Versions are considered vulnerable.

Current in Support Versions

Affected Versions

Spoiler: Affected Versions

6000.3
6000.3.0b4
6000.2
6000.2.6f2
6000.0 LTS
6000.0.58f2
2022.3 xLTS
2022.3.67f2
2021.3 xLTS
2021.3.56f2

We have extended fixes to out of support versions of the Unity Editor to include Unity 2019.1 and newer.

Out of Support Versions

Affected Versions

Spoiler: Affected Versions

6000.1
6000.1.17f1
2023.2
2023.2.22f1
2023.1
2023.1.22f1
2022.3 LTS
2022.3.62f2
2022.2
2022.2.23f1
2022.1
2022.1.25f1
2021.3 LTS
2021.3.45f2
2021.2
2021.2.20f1
2021.1
2021.1.29f1
2020.3
2020.3.49f1
2020.2
2020.2.8f1
2020.1
2020.1.18f1
2019.4 LTS
2019.4.41f1
2019.3
2019.3.17f1
2019.2
2019.2.23f1
2019.1
2019.1.15f1
2018.4
2018.3
2018.2
2018.1
2017.4
2017.3
2017.3.0b9+
2017.2
2017.2.0p4+
2017.1
2017.1.2p4+

Affected Platforms Table
Applications built with affected versions of the Unity Editor and released on these platforms could be impacted by the vulnerability.

Note: If a platform is not listed, there have been no findings to suggest that the vulnerability is exploitable.

Impact
Android
Code Execution / Elevation of Privilege

Windows
Elevation of Privilege

Linux (Desktop)
Elevation of Privilege

Linux (Embedded)
Elevation of Privilege

MacOS
Elevation of Privilege

On Microsoft Windows systems, the presence of a registered custom URI handler for a vulnerable application or handler name could increase the risk of exploitation. If a custom URI scheme is present and can be invoked on the target system, an attacker who can cause that URI to be opened could trigger the vulnerable library-loading behavior without needing direct command-line access. Potential exploitation remains constrained to the privileges of the targeted application and to the data and services accessible to that process. Entities that routinely create registered URI handlers for Unity applications are encouraged to contact Unity directly at security@unity3d.com.

Discovery
This vulnerability was responsibly reported by an external security researcher.

Remediation Steps
Rebuild Application
Update the Unity Editor to the newest version then rebuild and redeploy the application.
Binary Patch
Using the Unity Binary Patch tool for the target platform, the Unity runtime library can be replaced with a patched version of the library.
Unity Fixed Versions
Unity fixed versions: Direct links to the first fixed versions of the Unity Editor (which includes the Unity Runtime as well)

Patched Version

Spoiler: Pacthed Versions

6000.3.0b4
6000.2.6f2
6000.1.17f1
6000.0.58f2
2023.2.22f1
2023.1.22f1
2022.3.67f2
2022.3.62f2
2022.2.23f1
2022.1.25f1
2021.3.56f2
2021.3.45f2
2021.2.20f1
2021.1.29f1
2020.3.49f1
2020.2.8f1
2020.1.18f1
2019.4.41f1
2019.3.17f1
2019.2.23f1
2019.1.15f1

FAQ
My application or game is released on a platform or operating system not listed, what should I do?

If an application or game is released to a platform we have not listed, there have been no findings to suggest that the vulnerability is exploitable. For added security, however, we recommend that you rebuild your games and applications with updated Unity versions.

How was the vulnerability discovered?

The vulnerability was initially discovered by a third-party researcher.

What is the process for reporting future vulnerabilities to Unity?

We have a Responsible Disclosure policy as a part of our cooperation with internal and external security researchers and also have a Bug Bounty program. For more information on our Bug Bounty program, contact security@unity3d.com or visit our Bug Bounty program on Bugcrowd.

https://unity.com/security/sept-2025-01 (Archive)

 

[Orphaned Punk]

Supposidely, 25% of games sold and 50% of games published to steam are made with Unity. (Link) (Archived via PDF (Sorry!))
Supposidely, the market share for mobile is even larger.

 

[John Badman]

Huh, I didn’t know there was such a thing as safe file handling given that Unity hard crashes every time I use the damn thing.

 

[George Lucas]

This wouldn’t be so bad if Unity wasn’t positioning itself as a business-grade tool for enterprise applications.

 

[30+GameOvers]

Realistically, how can this even be exploited? Does this mean that, say, an old Unity game that isn't going to be updated can now be fucked with? Does this even matter for offline games?

 

[Borax Bozo]

Realistically, how can this even be exploited? Does this mean that, say, an old Unity game that isn't going to be updated can now be fucked with? Does this even matter for offline games?

Someone pointed out that games that run custom content (such as Steam Workshop entries) could end up getting exploited by a malicious upload.

 

[Croak & Caw]

Someone pointed out that games that run custom content (such as Steam Workshop entries) could end up getting exploited by a malicious upload.

Could probably affect people who pirate too.

 

[PhoBingas]

Could probably affect people who pirate too.

might even effect pirates more. More often than not it's not the most recent patch that's up on torrent sites, or have malicious shit added. Didn't that EMPRESS cracker lose their mind a couple years ago and started spouting radfem/troon shit?

 

[Nameless One]

My wifi source is a shitty hotspot, and I downloaded Hollow Knight and Silksong's unofficial android ports. I will take my risks because I am not about to fucking redownload them.

 

[BigGuyOS 6 : Jovial Janny]

So could this impact console?
It would be pretty sweet if it led to a universal crack for all current gen consoles and lead to CFW.
It's a local file attack, so loading a modified save file?

 

[Smaug's Smokey Hole 2]

Could probably affect people who pirate too.

When installing the game it already asks you to approve elevated privileges so you're already taking your chances there.

 

[Prokhor Zakharov]

which could enable local code execution or information disclosure at the privilege level of the vulnerable application.

Other IT kiwi's will know this is less of a problem than it could have been. Most game's (except the ones that run anti-cheat bullshit) run in userland with user level privileges, which for Linux in particular is quite restricted (in Windows it will have a little more access).

Still a problem given user level access to the file system is still rather extensive, and could lead to exfiltration of sensitive information for the user.

This might help explain some of the problems I've heard about recently with tokens being stolen using pirated games from end users where there was no known security compromise.

 

[Professional Noticer]

Im really surprised Unity is such a big deal in game development considering the pricing shit they pulled off a few years ago. I know they reverted it but I will never trust them again.
I would figure most of devs would have switched to UE or Godot, but I assume they didn't because they are used to Unity. A lot of skills are transferable but it's of course its not that simple.

I do some minor game jams here and there and I always use Godot, its really lightweight and easy to use. It's also open source so its constantly improving even if its still rough.
I understand that for AAA companies it might not be enough, but its pretty good for smaller indie projects, which is literally 95% of the games I play nowadays. I recommend anyone interested in game dev to start with it.

 

[Prokhor Zakharov]

I would figure most of devs would have switched to UE or Godot, but I assume they didn't because they are used to Unity. A lot of skills are transferable but it's of course its not that simple.

I think I remember something happening with Godot, it was taken over by trannies, or something like that. So that's not a viable option any longer.

 

[deleuzeon]

I would figure most of devs would have switched to UE or Godot, but I assume they didn't because they are used to Unity.

Godot would be much smarter for most of them business-wise, since it's open-source and has no licensing fees. If you succeed with Unity you will pay for the privilege. If you even release with UE you'll have to share your books with Epic for the rest of your life. Fun!

I think I remember something happening with Godot, it was taken over by trannies, or something like that. So that's not a viable option any longer.

Lol. If that's how someone is choosing the engine for their game project then they're probably ngmi.

 

[Croak & Caw]

I think I remember something happening with Godot

Godot team is full of trannies and lunatics as far as I remember. It got forked to Redot and trannies went rabid* for a while, but I think things calmed down for now. If the fork doesn't die I'll check it out. I tried Godot a while back and it felt really messy.

 

[Made In Wales]

Oh dear.

The new Football Manager 2026 game is being released on Unity next month.

Should I buy it or avoid, as I've heard nothing bad bad stuff about Unity.

 

[Professional Noticer]

Godot would be much smarter for most of them business-wise, since it's open-source and has no licensing fees.

Is sounds good in paper, but Godot is just not strong enough for a lot of stuff, especially in the 3D department.

You can put together a few assets in Unreal Engine 5 in 30 minutes and mess with the lightning and you end up with something that legit looks like a AAA game. The lighting system especially is incredible in Unreal, while also being really heavy (which is why Unreal games tend to chug a lot, but that's mostly because devs put everything to max and don't optimise at all).

Godot really can't compete with that level of graphics. For indies it doesnt matter as much of course. But the AAA companies wouldn't sell as many copies of their games if their graphics were mid.

I think I remember something happening with Godot, it was taken over by trannies, or something like that. So that's not a viable option any longer.

Yes, but that doesn't really apply to the engine at all. It was just a community manager or some shit. As long as you aren't posting on their gay little forums it really doesn't matter.
And an Open Source thing it has a lot of people contributing to it, which yes will always include some retards.

I was there during the Redot fork, but they were kinda directionless. Good idea, but most of us (including myself) were just there complaining about it being bullshit but most of us didn't have the skills to contribute anything meaningful considering most of us were amateur game devs. Im sure its better now but I'm not sure I wanna fuck around with Redot when Godot is still being updated.

Anyway, all the engines have problems. You just have to pick your poison:

• Unreal Engine - You have to deal with the dogshit blueprint system, but overall its a good choice. They only take money if you make a ton of money (I believe a million USD?), so its a good choice for indies as 99% will never reach that amount. Theres lot of support and games look good by default. Its just not great for smaller scale games (like indies) because its heavy.
• Unity - A ton of support out there for this one, but the company has shown to be filled with retards. They wanted to fucking rob everyone that used their engine, even people that made free games. Will it happen again? Maybe, maybe not, but i would urge anyone to consider NOT using this. They are not reliable and hey have shown to be malicious.
• Godot - Good, easy to learn, lightweight. Some documentation but not as much as the other 2. Not very suitable for "real" big complex games.
• RPG Maker - Easy to use, but its RPG maker. The games all look the same when you make them in RPG maker. Still, theres a lot of classics made with this engine. It's still producing bangers to this day (Don't Look Outside is an amazing game that came out just a couple of months ago). Also you need to pay for it upfront (but its not a lot).
• Gamemaker - I don't have a lot of experience with Gamemaker but its also a good choice from what I heard.
• Ren'py - Literally just used for Visual Novels, but hey, its a start if you have a good narrative idea. Free and Open Source as well. You can learn it in a few mins and make a funny story about lolcows for the next Kiwi GameJam.

Theres more but no one cares about the other ones. They exist but its not worth learning unless they have a very specific niche (like RenPy for Visual Novels).
Godot might not be perfect but as someone that loves open source and not being tied to companies, its still the best out there for me. If you wanna go into real pro development I would learn Unreal instead. Unity can go suck a dick for all I care.

 

[deleuzeon]

Is sounds good in paper, but Godot is just not strong enough for a lot of stuff, especially in the 3D department.

You can put together a few assets in Unreal Engine 5 in 30 minutes and mess with the lightning and you end up with something that legit looks like a AAA game. The lighting system especially is incredible in Unreal, while also being really heavy (which is why Unreal games tend to chug a lot, but that's mostly because devs put everything to max and don't optimise at all).

Godot really can't compete with that level of graphics. For indies it doesnt matter as much of course. But the AAA companies wouldn't sell as many copies of their games if their graphics were mid.

Yeah I agree, I was only speaking to indie situations really. The rendering abilities can seduce you, but then you end up trying to compete with other games that have AAA visuals when you don't have a AAA budget. It's arguably wiser to use an engine with less ability to go and overscope yourself visually, so you have to focus on fun.

 

[George Lucas]

Im really surprised Unity is such a big deal in game development considering the pricing shit they pulled off a few years ago. I know they reverted it but I will never trust them again.
I would figure most of devs would have switched to UE or Godot, but I assume they didn't because they are used to Unity. A lot of skills are transferable but it's of course its not that simple.

I do some minor game jams here and there and I always use Godot, its really lightweight and easy to use. It's also open source so its constantly improving even if its still rough.
I understand that for AAA companies it might not be enough, but its pretty good for smaller indie projects, which is literally 95% of the games I play nowadays. I recommend anyone interested in game dev to start with it.

Because Unity doesn’t make much money off the single-member businesses anyway. The money is in medium and large businesses that don’t really care about recurring license fees because that’s already the pricing model for all the other software their business uses.