Vulnerability in Apple macOS
CVE-2025-59489
Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the vulnerable Unity Runtime code, then an adversary may be able to execute code on, and exfiltrate confidential information from, the machine on which that application is running. NOTE: product status is provided for Unity Editor because that is the information available from the Supplier. However, updating Unity Editor typically does not address the effects of the vulnerability; instead, it is necessary to rebuild and redeploy all affected applications.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.006 (45.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 46th percentile — 45.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: +0.000
Affected products
- Apple macOS
- Google Android
- Linux Kernel
- Microsoft Windows
- Unity Editor — versions 2017.2.0p4+, 2017.3.0b9\+, 2017.3.0b9+
- Unity3d Unity Editor — versions 6000.3, 6000.2, 6000.0 LTS
Weakness classification (CWE)
Public proof-of-concept exploits
References
- unity.com/security (Product)
- unity.com/security/sept-2025-01 (Vendor Advisory)
- flatt.tech/research/posts/arbitrary-code-execution-in-unity-runtime/ (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2025-59489?
- CVE-2025-59489 is a high-severity vulnerability in Apple macOS, classified under Argument Injection. CVSS score: 7.4/10. Published 2025-10-03.
- How severe is CVE-2025-59489?
- High severity. CVSS v3 base score is 7.4 out of 10.
- Is CVE-2025-59489 known to be exploited?
- 24 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.