Unity Editor CVE-2025-59489: brief summary of argument injection vulnerability

Unity-based games and applications on Android, Windows, macOS, and Linux have been exposed to a high-severity vulnerability for years, allowing attackers to execute arbitrary code or escalate privileges through argument injection and malicious native library loading. With Unity powering over half of all games across mobile and PC platforms, per Sensor Tower's 2025 Game Engines Report, and countless cross-platform apps, the impact of CVE-2025-59489 is broad and far-reaching across the software industry.

TLDR:

• CVE-2025-59489 is a high-severity argument injection flaw (CWE-88: Improper Neutralization of Argument Delimiters) in Unity Editor versions 2017.1 through 6000.3, carrying a CVSS score of 8.4 HIGH.
• Attackers abuse the -xrsdk-pre-init-library argument to load malicious native libraries, resulting in arbitrary code execution.
• Affected platforms include Android, Windows, macOS, and Linux, covering the majority of Unity-built games and applications.
• Unity released patches on October 2, 2025. Developers must rebuild applications with a patched editor or apply Unity's binary patch tool.
• As of July 2026, many older and unmaintained Unity titles remain unpatched, leaving users at risk. Unity has confirmed no evidence of exploitation in the wild as of July 2026.

What is CVE-2025-59489 in Unity Editor?

CVE-2025-59489 is a high-severity vulnerability in Unity Editor that allows an attacker to load attacker-controlled native libraries into a running Unity application. Classified as an argument injection vulnerability (CWE-88: Improper Neutralization of Argument Delimiters), it carries a CVSS score of 8.4 HIGH, reflecting the potential for arbitrary code execution and privilege escalation. The root mechanism is a failure to sanitize application startup and intent parameters: attackers inject debugging commands such as -xrsdk-pre-init-library, -dataFolder, or -monoProfiler, forcing the app to fetch and execute a malicious local binary. The flaw was identified by RyotaK of GMO Flatt Security Inc. on June 4, 2025, and reported responsibly before Unity released patches.

The flaw spans Unity Editor versions 2017.1 through 6000.3, covering over eight years of engine releases. Any application built with a vulnerable editor version and deployed on Android, Windows, macOS, or Linux is at risk. On Android, a malicious app already on the same device can trigger the exploit without additional user interaction. On Windows, a Unity application with a custom URI handler can be remotely targeted via a crafted URI, without requiring physical access to the device.

How CVE-2025-59489 exploits Unity's argument injection flaw

Root cause: argument injection via unsanitized startup parameters

CVE-2025-59489 affects Unity Editor versions 2017.1 through 6000.3. The root cause is a failure in the Unity Runtime to sanitize application startup parameters and Android intent parameters. This allows attackers to inject debugging commands including -xrsdk-pre-init-library, -dataFolder, and -monoProfiler into the Unity process at launch. The -xrsdk-pre-init-library argument was intended to allow legitimate pre-initialization of native libraries, but without proper sanitization, it can be used to load attacker-controlled .dll, .so, or .dylib files from arbitrary locations.

Exploitation scenarios by platform

When a Unity application is launched with an injected argument, the Unity Runtime loads the specified library without validating its origin or integrity. This is the CWE-88 argument injection mechanism. On Android, a separate low-privilege malicious app uses Android Intents to inject arguments into the target Unity game, hijacking its higher system permissions without additional user interaction. On Windows, if a Unity app registers a custom URI scheme (for example, yourgame://), an attacker can craft a browser link that passes the malicious argument, though the attacker must first drop a malicious DLL into a known path that the application can reach.

The vulnerability allows arbitrary code execution with the privileges of the Unity application, including access to sensitive permissions or user data. No public code snippets are available for this vulnerability. The flaw is present in all Unity Editor versions from 2017.1 through 6000.3.

A key remediation detail: the vulnerable code lives in the Unity Runtime engine, which gets compiled directly into the player build. Updating the Unity Editor on a developer machine does not retroactively secure games or apps already deployed to users. Developers must update the editor, then fully recompile and redeploy every affected application. Unity's binary patch tool offers an alternative for certain operating systems, allowing developers to inject a binary-level fix into pre-built packages without a full rebuild.

Detecting CVE-2025-59489 in Unity applications

Detecting unauthorized code execution in Unity applications requires a combination of static and runtime analysis techniques to identify potential vulnerabilities and malicious activity.

Static detection: identifying vulnerable artifacts

1. Build Artifact Auditing: Because the flaw is compiled directly into the Unity Runtime, detection starts with auditing your build outputs. On Windows, check the file version properties of UnityPlayer.dll. If the product version falls within 2017.1 to 6000.3 and the file has not been processed by Unity's Binary Patch Tool, the build is vulnerable. On Android, decompile the APK and inspect the Unity version string inside assets/bin/Data/Resources/unity_builtin_extra, or check the properties of libunity.so.

Runtime monitoring: flagging exploit invocations

1. Process Argument Logging (Windows EDR / Sysmon Event ID 1): Monitor for any Unity application executable launched with the command-line arguments associated with this vulnerability: -xrsdk-pre-init-library, -monoProfiler, or -dataFolder. Any process creation event containing these arguments against a Unity executable should be treated as a high-confidence alert.
2. Android Intent Monitoring: Audit device logs via logcat for third-party applications sending unexpected or unvalidated Android Intents containing string arguments directly to a Unity Game Activity. An unknown app delivering these argument strings to a Unity process is a strong indicator of an active exploitation attempt.

Indicators of compromise (IoCs)

• Untrusted Library Image Loads: A Unity executable (UnityPlayer.exe or libunity.so) loading a native library (.dll, .so, or .dylib) from a user-writable directory (for example C:\Users\Public\ on Windows or /data/local/tmp/ on Android). Libraries loaded from these paths were not bundled with the application and should be treated as suspect.
• Rogue Child Processes: The Unity process spawning an unexpected system shell such as cmd.exe, powershell.exe, or /bin/sh. A Unity game should never spawn a shell at runtime; any such child process creation is a high-confidence indicator that an injected payload has executed.

Which Unity Editor versions are vulnerable to CVE-2025-59489

• Unity Editor versions 2017.1 through 6000.3 are affected.
• All applications built with these Unity Editor versions are vulnerable.
• Platforms impacted: Android, Windows, macOS, Linux.
• Exploitation possible via crafted local applications and, on Windows, via custom URI handlers.
• Patches became available on October 2, 2025, covering all in-support versions and out-of-support versions back to Unity 2019.1. Unity Editor versions 2017.x and 2018.x are also affected by the vulnerability but have not received a patch; applications built on those versions should be rebuilt with a supported editor release. Developers should rebuild and redeploy applications using a patched Unity Editor version or apply Unity's binary patch tool.

CVE-2025-59489 patch status and platform response as of July 2026

Patches for CVE-2025-59489 have been available since October 2, 2025, covering all in-support Unity versions and out-of-support versions back to Unity 2019.1. Developers can either rebuild their application with a patched Unity Editor version or apply Unity's binary patch tool to existing builds without a full rebuild.

The broader platform response was swift. Microsoft added detection rules to Microsoft Defender for CVE-2025-59489 and began identifying potentially affected first-party games and applications for update. Valve deployed a Steam Client update that blocks game launches containing the four command-line parameters associated with the exploit.

As of July 2026, the patch has been available for over nine months, yet a large share of older or unmaintained Unity-built titles on Android and PC likely remain unpatched. Unity forum discussions from the disclosure period indicate that a high proportion of legacy games may never be rebuilt by their developers. Unity has confirmed no evidence of exploitation in the wild, though the window of exposure for unpatched titles remains open. End users can check whether a game has been updated by reviewing its store page or release notes for patch references dated after October 2, 2025. Developers with active titles should confirm their builds use one of the patched Unity versions listed in the official security advisory.

CVE-2025-59489 in broader context: argument injection risk beyond the patch

Patching Unity closes CVE-2025-59489. It does not close CWE-88. The argument injection class keeps appearing because the root cause is structural: applications that accept attacker-influenced parameters and pass them to native library loaders without sanitization inherit this entire class of risk regardless of engine version. Unity's advisory fixed one instance of that pattern in a specific set of startup arguments. The same logic applies to any application layer that sits above the engine and loads native code at runtime.

For Unity developers, the practical implication runs in two directions. First, custom plugins and native extensions built on top of Unity can carry the same pattern if they accept arguments, file paths, or library names from attacker-controlled parameters without sanitizing them first. A rebuilt application that runs on a patched Unity Editor still carries exposure if its own code accepts and passes through injected parameters as the engine used to. Second, the class of attack that CVE-2025-59489 made concrete on Android, where a co-installed malicious app uses Android Intents to inject arguments into the target application, is a recognized pattern in mobile threat research well beyond this single CVE. Valve's Steam Client mitigation, blocking the three exploit-associated command-line parameters at the launcher level, is a containment measure for one delivery mechanism, not a defense against the class.

Security teams reviewing Unity-based products should treat the October 2025 advisory as a starting point, not a close. The audit question goes beyond "did we rebuild on a patched editor?" to ask: "do any of our native plugin integrations, custom launch arguments, or in-app update mechanisms accept unsanitized parameters or library paths from an external source?" That second question is where the class-level risk lives, and it requires code review that no engine patch covers.

Unity's security track record and CVE disclosure history

Unity Technologies has a track record of fixing vulnerabilities quickly and transparently. Previous issues include CVE-2021-44228 and CVE-2021-45046, which affected the Apache Log4j Java library used in Unity's build toolchain (Unity advisory UNITY-SEC-21720), as well as CVE-2019-9197 and earlier input-validation RCEs in the engine itself. The company runs a bug bounty program on HackerOne and coordinates with external researchers for responsible disclosure. For CVE-2025-59489, the patch shipped October 2, 2025, with full details in the official Unity security advisory. Security advisories and updates are published regularly, with fixes provided for both current and out-of-support versions when necessary.

How ZeroPath helps you stay ahead of vulnerabilities like CVE-2025-59489

CVE-2025-59489 gets fixed by upgrading Unity. CWE-88 does not. Argument injection patterns appear in custom application code, third-party packages, and infrastructure configuration regardless of which engine version ships underneath. The advisory exposes a gap most teams cannot see: whether their own code above the engine carries the same class of flaw.

ZeroPath is an AI-native application security platform that covers the detection, fix generation, and verification layers in a single loop. SAST scans the code your team writes: custom C# scripts, native C++ plugins, and wrapper applications sitting above the engine. It catches argument injection patterns, unsanitized parameter passing, and unsafe native library loading in that custom code layer. It cannot scan the pre-compiled, closed-source Unity engine binaries (UnityPlayer.dll, libunity.so) themselves. A flaw baked into those binaries, like CVE-2025-59489, requires an engine-level fix (upgrading Unity or applying the binary patch tool). ZeroPath's SAST coverage applies to the custom code your team ships on top of the engine, checking whether it introduces the same argument injection class of flaw.

When ZeroPath confirms a finding, it generates a patch, opens a PR, and reruns verification on the merged code before marking the issue as resolved. Your team does not manage a static backlog of findings. Each one moves through a detect-fix-verify cycle. SCA with reachability analysis flags vulnerable dependencies only when the affected code path is actually called in your codebase, cutting alert volume without hiding real risk. Secrets scanning and IaC scanning run in the same pass, so exposed credentials and misconfigured cloud infrastructure surface alongside code vulnerabilities in a single scan.

When a new advisory drops for a package in your dependency tree, ZeroPath's targeted SCA alerting fires only when the advisory affects the exact version ranges you are running. Advisory updates that change documentation links or metadata without touching vulnerable versions do not generate noise. Your team sees only findings that require action.

PR scans complete in under one minute across SAST, SCA, secrets, and IaC running in parallel, with inline fix suggestions posted directly on the diff. Developers see the finding, the fix, and the verified result before the branch merges. That loop runs 300,000+ times per month across Fortune 500 customers. The false positive rate drops because AI validation checks each finding before it surfaces, not after a developer has already wasted time on it: over 75% fewer false positives and 2x as many real vulnerabilities found, per ZeroPath's internal data. For a vulnerability class like CWE-88, where the dangerous pattern is an unsanitized parameter passed to a native loader, that reasoning-based detection is what closes the gap left open in your own code.

Final thoughts on CVE-2025-59489 patch recap and next steps for Unity security

CVE-2025-59489 is a reminder that widely deployed runtimes can harbor exploitable vulnerabilities for years before disclosure. With patches available since October 2025 and platform holders like Microsoft and Valve already acting, the path forward for developers is clear: rebuild with a patched Unity Editor version and confirm your builds are covered by checking the official security advisory. For security teams managing portfolios that include Unity-based products, this disclosure is also a good time to ask whether your application security posture keeps pace with new CVEs across your stack, beyond the engine layer. To see how ZeroPath scans your custom code and dependencies for vulnerabilities before they reach production, request a demo.

FAQ

What is CVE-2025-59489?

CVE-2025-59489 is a high-severity argument injection vulnerability (CWE-88: Improper Neutralization of Argument Delimiters) in Unity Editor versions 2017.1 through 6000.3. The Unity Runtime fails to sanitize application startup and intent parameters, allowing attackers to inject debugging commands such as -xrsdk-pre-init-library to load attacker-controlled native libraries into a running Unity application, leading to arbitrary code execution with the privileges of the Unity process.

Which Unity versions are affected by CVE-2025-59489?

All Unity Editor versions from 2017.1 through 6000.3 are affected. Applications built with these versions and running on Android, Windows, macOS, or Linux are at risk. Unity released patches for all in-support and out-of-support versions back to 2019.1, on October 2, 2025. Versions 2017.x and 2018.x are affected but received no patch.

Has Unity released a patch for CVE-2025-59489?

Yes. Unity released patches on October 2, 2025. Developers can either rebuild their application using a patched version of the Unity Editor or apply Unity's binary patch tool to existing builds without a full rebuild. The official Unity security advisory lists all patched versions and guidance on applying the binary patch tool.

Can end users protect themselves from CVE-2025-59489?

End users cannot patch the vulnerability themselves; remediation requires the game or application developer to rebuild with a patched Unity Editor version. Users can check a game's store page or release notes for patch references dated after October 2, 2025. Valve's Steam Client update blocks launches that include the four exploit-associated command-line parameters, providing partial mitigation for Steam games.

What makes CVE-2025-59489 especially dangerous on Android?

On Android, a malicious app already installed on the same device can extract its own native libraries and trigger a vulnerable Unity application with the crafted -xrsdk-pre-init-library argument. This requires no additional user interaction beyond installing the malicious app, making the exploitation path more straightforward than with many other mobile vulnerabilities.