CVE-2025-59489

State: Published
Severity: 7.4 High
Published: Oct 3, 2025
Updated: Oct 3, 2025
Reserved: Sep 16, 2025

Description

Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the vulnerable Unity Runtime code, then an adversary may be able to execute code on, and exfiltrate confidential information from, the machine on which that application is running. NOTE: product status is provided for Unity Editor because that is the information available from the Supplier. However, updating Unity Editor typically does not address the effects of the vulnerability; instead, it is necessary to rebuild and redeploy all affected applications.

Scores

CVSS	Score	Vector	Source
3.1	7.4 High	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	mitre
3.1	8.4 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CWE-426 Untrusted Search Path

Affected Products

Product	Versions
Unity EditorUnity3D	6000.3 to before 6000.3.0b4Affected 6000.2 to before 6000.2.6f2Affected 6000.0 LTS to before 6000.0.58f2Affected 2022.3 xLTS to before 2022.3.67f2Affected 2021.3 xLTS to before 2021.3.56f2Affected 6000.1 to before 6000.1.17f1Affected 2023.2 to before 2023.2.22f1Affected 2023.1 to before 2023.1.22f1Affected 2022.3 LTS to before 2022.3.62f2Affected 2022.2 to before 2022.2.23f1Affected 2022.1 to before 2022.1.25f1Affected 2021.3 LTS to before 2021.3.45f2Affected 2021.2 to before 2021.2.20f1Affected 2021.1 to before 2021.1.29f1Affected 2020.3 to before 2020.3.49f1Affected 2020.2 to before 2020.2.8f1Affected 2020.1 to before 2020.1.18f1Affected 2019.4 LTS to before 2019.4.41f1Affected 2019.3 to before 2019.3.17f1Affected 2019.2 to before 2019.2.23f1Affected 2017.1.2p4 to before 2019.1.15f1Affected

Product

Versions

Unity EditorUnity3D

6000.3 to before 6000.3.0b4Affected
6000.2 to before 6000.2.6f2Affected
6000.0 LTS to before 6000.0.58f2Affected
2022.3 xLTS to before 2022.3.67f2Affected
2021.3 xLTS to before 2021.3.56f2Affected
6000.1 to before 6000.1.17f1Affected
2023.2 to before 2023.2.22f1Affected
2023.1 to before 2023.1.22f1Affected
2022.3 LTS to before 2022.3.62f2Affected
2022.2 to before 2022.2.23f1Affected
2022.1 to before 2022.1.25f1Affected
2021.3 LTS to before 2021.3.45f2Affected
2021.2 to before 2021.2.20f1Affected
2021.1 to before 2021.1.29f1Affected
2020.3 to before 2020.3.49f1Affected
2020.2 to before 2020.2.8f1Affected
2020.1 to before 2020.1.18f1Affected
2019.4 LTS to before 2019.4.41f1Affected
2019.3 to before 2019.3.17f1Affected
2019.2 to before 2019.2.23f1Affected
2017.1.2p4 to before 2019.1.15f1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.