High 7.4Published Oct 2, 2025

CVE-2025-59489Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location.

Updated under an hour ago (Oct 26, 2026, 2:00 PM ET)

Does this affect you?

It affects Unity3D Unity Editor and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Unity3D Unity Editor

Exploited in the last 30 days

Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the vulnerable Unity Runtime code, then an adversary may be able to execute code on, and exfiltrate confidential information from, the machine on which that application is running. NOTE: product status is provided for Unity Editor because that is the information available from the Supplier. However, updating Unity Editor typically does not address the effects of the vulnerability; instead, it is necessary to rebuild and redeploy all affected applications.

CVSS: 7.4 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-88, CWE-426
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: mitre
NVD analysis: Analyzed
Record last updated: Oct 3, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Unity3D Unity Editor unity3d:unity_editor (from the name)	from 6000.3 before 6000.3.0b4; from 6000.2 before 6000.2.6f2; from 6000.0 LTS before 6000.0.58f2; from 2022.3 xLTS before 2022.3.67f2; from 2021.3 xLTS before 2021.3.56f2; from 6000.1 before 6000.1.17f1; from 2023.2 before 2023.2.22f1; from 2023.1 before 2023.1.22f1; and 13 more ranges	CNA record
unity editor unity:editor	from 2017.4 through 2018.4; from 2019.1 before 2019.1.15f1; from 2019.2 before 2019.2.23f1; from 2019.3 through 2019.3.17f1; from 2019.4 before 2019.4.41f1; from 2020.1 before 2020.1.18f1; from 2020.2 before 2020.2.8f1; from 2020.3 before 2020.3.49f1; and 15 more ranges	NVD

References

References

https://unity.com/security#security-updates-and-patches	product
https://unity.com/security/sept-2025-01	vendor-advisory
https://flatt.tech/research/posts/arbitrary-code-execution-in-unity-runtime/	exploit, third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.