Unity Flaw CVE-2025-59489 Allows Local Code Execution in Millions of Games

A vulnerability in the Unity Runtime, tracked as CVE-2025-59489 with a CVSS of 8.4, could allow local file inclusion and code execution in millions of Android and cross‑platform games built with Unity, according to Unity’s advisory.

The flaw arises from the Android UnityPlayerActivity’s intent handling, where the unity extra is parsed as command-line arguments and can be exploited by injecting malicious arguments to load arbitrary shared libraries via dlopen, enabling code execution with the target app’s permissions.

The article explains a tested scenario where a second app on the device can send an crafted intent to load a malicious .so file, and notes that, in theory, a malicious website could trigger the exploit via intent URLs if the Unity activity is exposed to browsers. Android’s SELinux policy mitigates most remote exploitation by blocking dlopen in the downloads directory, though bypasses exist if attacker‑controlled files are placed in private storage.

Patches have been released for Unity Editor versions from 2019.1 onward, including 6000.0.58f2, 2022.3.67f2, 2021.3.56f2, 2020.3.49f1 and 2019.4.41f1, and developers are urged to update, recompile, and republish their games; Unity also offers a Binary Patch tool for legacy projects.