A code execution vulnerability in the Unity game engine could be exploited to achieve code execution on Android and privilege escalation on Windows. Unity is a cross-platform game engine and development platform that provides rendering, physics, animation, and scripting tools for developers to create titles for Windows, macOS, Android, iOS, consoles, and the web. A large number of mobile games are built with Unity, as well as indie and mid-tier PC/console titles. The platform is also used in non-gaming industries for real-time 3D applications. In response to the risk, Steam has taken action by releasing a new Client update that blocks the launching of custom URI schemes to prevent exploitation through its distribution platform. At the same time, Valve recommends that publishers rebuild their games using a safe Unity version, or plug a patched version of the ‘UnityPlayer.dll’ file right into their existing builds. Microsoft has also published a bulletin to warn about the issue, recommending users to uninstall vulnerable games until new versions that address CVE-2025-59489 become available. The company said that popular game titles are vulnerable, including Hearthstone, The Elder Scrolls: Blades, Fallout Shelter, DOOM (2019), Wasteland 3, and Forza Customs. Unity recommends developers to update the editor to the latest version branch and then recompile and redeploy their games or applications. The vulnerability is tracked as CVE-2025-59489 and affects the Runtime component. It...
Steam and Microsoft warn of Unity flaw exposing gamers to attacks
BleepingComputer
·Bill Toulas
·Published Oct 6, 2025
·Updated
Affected Software
2 affected components
Unity Technologies Unity
Valve Steam
Frequently Asked Questions
1
What is the main topic of this article?
The article discusses a vulnerability in the Unity game engine that exposes gamers to potential cyberattacks.
2
What security implications are discussed in the article?
The article highlights a code execution vulnerability that could allow attackers to execute malicious code on Android and escalate privileges on Windows.
3
What products or software are affected by the Unity flaw?
The affected products include the Unity game engine and apps made with Unity, as well as the Valve Steam platform.
4
Who issued the warning about the Unity flaw?
Both Steam and Microsoft issued warnings regarding the Unity vulnerability.
5
What types of attacks can exploit the Unity vulnerability?
The vulnerability can be exploited for remote code execution on Android devices and privilege escalation on Windows systems.