Critical Unity vulnerability forces urgent game patches across Android, Linux, and macOS
A long-hidden flaw in the Unity engine has come to light, and studios are scrambling to protect players. The security issue, tracked as CVE-2025-59489, has existed since 2017 and allows arbitrary code execution through argument injection in the Unity Runtime. In practical terms, a local attacker could load malicious libraries and potentially escalate privileges on affected systems.
The vulnerability was discovered on June 4, 2025, by security researcher RyotaK of GMO Flatt Security Inc. It affects games and apps built with Unity version 2017.1 and later on Android, Linux, and macOS. According to the Common Vulnerability Scoring System (CVSS), the issue carries a High severity rating of 8.4 out of 10.
Unity disclosed the problem on October 2, 2025, and began rolling out fixes the same day. Patches are available for Unity Editor versions starting from 2019.1, and a binary patcher tool enables developers to retrofit older builds dating back to 2017.1. Unity says it has seen no evidence of real-world exploitation or customer impact and emphasized that fixes are already available to all developers.
The industry reaction was swift. Major studios and indie teams temporarily pulled or updated titles while implementing patches. Obsidian Entertainment removed several Unity-built releases, including Pillars of Eternity II: Deadfire and Pentiment, on October 3. Among Us developer Innersloth and Marvel Snap studio Second Dinner confirmed updates for their mobile games. PsychoFlux Entertainment patched 11 Steam titles such as Gravity Castle and Fingerdance, and Tenbris Studio updated its horror game “Your Computer Might be At Risk” on Steam.
The incident underscores how dormant bugs can reside in legacy code for years, even in software that powers a vast portion of the industry. Unity’s tools and rapid response may help limit fallout for an engine that reportedly underpins as many as 750,000 games across AAA and indie development.
What developers should do now
– Update to a patched Unity Editor version (2019.1 or later) and rebuild affected projects.
– Use Unity’s binary patcher to retrofit previously released builds dating back to 2017.1.
– Recompile and republish across Android, Linux, and macOS to ensure users receive fixed binaries.
– Validate that launch arguments and library loading behavior are hardened after patching.
– Run regression and platform-specific tests, then monitor official security advisories for further updates.
What players should do
– Update your games as patches roll out on storefronts and launchers.
– If a game is temporarily unavailable, expect it to return once the developer completes the security update.
Bottom line: CVE-2025-59489 is a serious but addressable problem. With fixes now available and studios actively shipping updates, the fastest path to safety is simple—developers should rebuild and republish, and players should install updates as they arrive.
