ZDI-23-240: Unity Technologies Unity Editor FBX File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
Published Mar 15, 2023
·Updated
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unity Technologies Unity Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
Affected Software
1 affected component
Unity Technologies Unity Editor
Event History
Mar 15, 2023
Advisory Published
05:00 AM
Data Sourced
05:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-23-240?
ZDI-23-240 is classified as a critical vulnerability allowing remote code execution.
2
How do I fix ZDI-23-240?
To fix ZDI-23-240, update your Unity Editor to the latest version provided by Unity Technologies.
3
What type of attack does ZDI-23-240 involve?
ZDI-23-240 involves remote attackers executing arbitrary code through manipulative user interaction.
4
What versions of Unity Editor are affected by ZDI-23-240?
ZDI-23-240 affects all installations of Unity Technologies Unity Editor without specific version limitations.
5
What action must a user take to exploit ZDI-23-240?
A user must visit a malicious page or open a malicious file to exploit ZDI-23-240.