ZDI-23-236: Unity Technologies Unity Editor SKP File Parsing Use-After-Free Remote Code Execution Vulnerability
Published Mar 15, 2023
·Updated
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unity Technologies Unity Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
Affected Software
1 affected component
Unity Technologies Unity Editor
Event History
Mar 15, 2023
Advisory Published
05:00 AM
Data Sourced
05:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-23-236?
The severity of ZDI-23-236 is high due to its potential for remote code execution.
2
How do I fix ZDI-23-236?
To fix ZDI-23-236, update to the latest version of Unity Editor as released by Unity Technologies.
3
Who is affected by ZDI-23-236?
Users of the affected installations of Unity Technologies Unity Editor are at risk from ZDI-23-236.
4
What type of attack is ZDI-23-236 associated with?
ZDI-23-236 is associated with remote code execution attacks that require user interaction.
5
What must a user do to exploit ZDI-23-236?
To exploit ZDI-23-236, a user must visit a malicious page or open a malicious file.