Vulnerability in Apple macOS
CVE-2025-59489
Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the vulnerable Unity Runtime code, then an adversary may be able to execute code on, and exfiltrate confidential information from, the machine on which that application is running. NOTE: product status is provided for Unity Editor because that is the information available from the Supplier. However, updating Unity Editor typically does not address the effects of the vulnerability; instead, it is necessary to rebuild and redeploy all affected applications.
EPSS: 0.006 (44.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apple Macos
- Google Android
- Linux Linux_kernel
- Microsoft Windows
- Unity Editor — versions 2017.1.2p4\+, 2017.2.0p4\+, 2017.3.0b9\+
- Unity3d Unity Editor — versions 6000.3, 6000.2, 6000.0 LTS
Weakness classification (CWE)
Public proof-of-concept exploits
- AdriianFdz/Exploit-CVE-2025-59489
- AheadAlot/CISC-486-Group-14-Project
- GithubKillsMyOpsec/CVE-2025-59489-POC
- RealtekDotSys/Meteor
- Utkarsh-Sharan/Angry-Birds-Clone
- Utkarsh-Sharan/Bounce-Dash
- Utkarsh-Sharan/Chest-System
- Utkarsh-Sharan/Inventory-And-Shop-System
- Utkarsh-Sharan/Powerup-Mania
- Utkarsh-Sharan/Shader-Development
References
- cve@mitre.org (Product)
- cve@mitre.org (Vendor Advisory)
- cve@mitre.org (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2025-59489?
- CVE-2025-59489 is a high-severity vulnerability in Apple macOS, classified under Argument Injection. CVSS score: 7.4/10. Published 2025-10-03.
- How severe is CVE-2025-59489?
- High severity. CVSS v3 base score is 7.4 out of 10.
- Is CVE-2025-59489 known to be exploited?
- 24 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.