Microsoft and Steam Take Action as Unity Vulnerability Puts Games at Risk

A high-severity vulnerability in the Unity editor can allow attackers to load arbitrary libraries and achieve code execution, tracked as CVE-2025-59489 with a CVSS score of 8.4. According to Unity, the issue resides in command-line arguments used to load and run code, and exploitation could occur if a malicious argument points a Unity application to a malicious native library.

Unity has addressed the flaw in Editor versions 6000.3.0b4, 6000.2.6f2, 6000.0.58f2, 2022.3.67f2, and 2021.3.56f2, with fixes also pushed to discontinued versions down to 2019.1, and developers are urged to update and rebuild their applications.

Microsoft says it is working to identify potentially affected games and has added exploitation detection rules to Microsoft Defender, while Valve has released a Steam Client update that blocks launching games containing one of four command-line parameters linked to the flaw. If a game is under active development, Unity offers a newer Editor version to rebuild the game, and for those unable to rebuild, patched UnityPlayer.dll files can be dropped into existing game folders.