CVE-2025-59489: Unity Editor vulnerability (CVSS 7.4)

Description

Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the vulnerable Unity Runtime code, then an adversary may be able to execute code on, and exfiltrate confidential information from, the machine on which that application is running. NOTE: product status is provided for Unity Editor because that is the information available from the Supplier. However, updating Unity Editor typically does not address the effects of the vulnerability; instead, it is necessary to rebuild and redeploy all affected applications.

CVSS 3.1 breakdown

Attack vectorLocal

Attack complexityHigh

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Unity Editor≥ 2017.4 ≤ 2018.4 · ≥ 2019.1 < 2019.1.15f1 · ≥ 2019.2 < 2019.2.23f1 · ≥ 2019.3 ≤ 2019.3.17f1

Remediation

Fixed in

Unity Editor≥ 2019.1.15f1

Patch & vendor advisories

https://unity.com/security/sept-2025-01

References

https://flatt.tech/research/posts/arbitrary-code-execution-in-unity-runtime/ExploitThird Party Advisory
https://unity.com/security#security-updates-and-patchesProduct
https://unity.com/security/sept-2025-01Vendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2025-59489 being actively exploited?

CVE-2025-59489 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.64%.

How severe is CVE-2025-59489?

CVE-2025-59489 has a CVSS 3.1 base score of 7.4, rated high. EPSS estimates a 0.64% probability of exploitation.

Which products are affected by CVE-2025-59489?

Affected products include Unity Editor.

How do I fix CVE-2025-59489?

Upgrade affected software to a fixed version, for example Unity Editor 2019.1.15f1 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-59489 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo