CVE-2025-59489
Published: 03 October 2025
Summary
CVE-2025-59489 is a high-severity Argument Injection (CWE-88) vulnerability in Unity Editor. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 4.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-32504
Vulnerability details
Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the vulnerable…
more
Unity Runtime code, then an adversary may be able to execute code on, and exfiltrate confidential information from, the machine on which that application is running. NOTE: product status is provided for Unity Editor because that is the information available from the Supplier. However, updating Unity Editor typically does not address the effects of the vulnerability; instead, it is necessary to rebuild and redeploy all affected applications.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Argument injection vulnerability in Unity Runtime allows adversaries to coerce applications into loading arbitrary libraries from attacker-specified paths via command-line arguments (e.g., xrsdk-pre-init-library), enabling client-side exploitation (T1203) and hijacking execution flow through DLL hijacking on Windows (T1574.001) or dylib/shared object hijacking on macOS/Linux/Android (T1574.004).
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.