CVE-2025-59489: CVE-2025-59489: Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument inje…

What it is

Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the vulnerable Unity Runtime code, then an adversary may be able to execute code on, and exfiltrate confidential information from, the machine on which that application is running. NOTE: product status is provided for Unity Editor because that is the information available from the Supplier. However, updating Unity Editor typically does not address the effects of the vulnerability; instead, it is necessary to rebuild and redeploy all affected applications.

Exploitation evidence

First exploit evidence seen: 2025-10-06 (earliest date across the sources below).

Exploited in the wild

No source on this site lists in-the-wild exploitation yet (CISA KEV, VulnCheck KEV).

Public exploit code

GitHub proof-of-concept repositories

2 public repositories from 2 accounts, first seen 2025-10-06. Most starred: GithubKillsMyOpsec/CVE-2025-59489-POC (39 stars), view repository.

Verify before running: public PoCs can be malicious. Read the code and only run it in an isolated lab. A PoC means exploit code is public, not that this CVE is exploited in the wild.

Sources: nomi-sec/PoC-in-GitHub.

How to fix it

Fixed versions

• unity editor: upgrade to 2019.1.15f1 or later (affected from 2019.1)
• unity editor: upgrade to 2019.2.23f1 or later (affected from 2019.2)
• unity editor: upgrade to 2019.4.41f1 or later (affected from 2019.4)
• unity editor: upgrade to 2020.1.18f1 or later (affected from 2020.1)
• unity editor: upgrade to 2020.2.8f1 or later (affected from 2020.2)
• unity editor: upgrade to 2020.3.49f1 or later (affected from 2020.3)
• unity editor: upgrade to 2021.1.29f1 or later (affected from 2021.1)
• unity editor: upgrade to 2021.2.20f1 or later (affected from 2021.2)
• unity editor: upgrade to 2021.3.45f2 or later (affected from 2021.3)
• unity editor: upgrade to 2022.1.25f1 or later (affected from 2022.1)
• unity editor: upgrade to 2022.2.23f1 or later (affected from 2022.2)
• unity editor: upgrade to 2022.3.62f2 or later (affected from 2022.3)
• unity editor: upgrade to 2023.1.22f1 or later (affected from 2023.1)
• unity editor: upgrade to 2023.2.22f1 or later (affected from 2023.2)
• unity editor: upgrade to 6000.0.58f2 or later (affected from 6000.0)
• unity editor: upgrade to 6000.1.17f1 or later (affected from 6000.1)
• unity editor: upgrade to 6000.2.6f2 or later (affected from 6000.2)
• unity editor: upgrade to 6000.3.0b4 or later (affected from 6000.3)

Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.

Vendor advisories and patches

• https://unity.com/security/sept-2025-01 (Vendor Advisory)

MITRE ATT&CK mitigations for this chain

• M1038 Execution Prevention (for T1574.008) : Adversaries will likely need to place new binaries in locations to be executed through this weakness. Identify and block potentially malicious software executed path interception by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate.
• M1022 Restrict File and Directory Permissions (for T1574.008) : Ensure that proper permissions and directory access control are set to deny users the ability to write files to the top-level directory <code>C:</code> and system directories, such as <code>C:\Windows\</code>, to reduce places where malicious files could be placed for execution. Require that all executables be placed i
• M1047 Audit (for T1574.008) : Find and eliminate path interception weaknesses in program configuration files, scripts, the PATH environment variable, services, and in shortcuts by surrounding PATH variables with quotation marks when functions allow for them. Be aware of the search order Windows uses for executing or loading binaries and use fully q

Detection Generic guidance

• Execution: Watch for the service process spawning shells or script interpreters (cmd.exe, powershell, sh, bash, python) via EDR process-tree rules.

Response checklist Generic guidance

1. Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
2. Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
3. Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
4. Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.