Argument injection and arbitrary library loading in Unity Runtime
CVE-2025-59489 is a high-severity vulnerability in Unity Runtime affecting applications built with vulnerable Unity Editor versions, reported across Android, Windows, macOS, and Linux. The flaw is caused by improper handling of command-line arguments, specifically the "-xrsdk-pre-init-library" parameter, which can be influenced by an attacker and used to force the runtime to load a native library from an unintended location. The issue is described as an argument injection condition that creates an untrusted search path / unintended library load scenario. On Android, reporting indicates the issue is tied to Unity debugging support, where an exported UnityPlayerActivity can accept attacker-controlled intent extras that are passed as command-line arguments. On Windows, exploitation risk increases where a vulnerable Unity application exposes a custom URI handler that can be abused to pass crafted arguments. Successful exploitation results in loading attacker-controlled native code into the target Unity application process.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository is a Proof-of-Concept (PoC) exploit for CVE-2025-59489, targeting Unity-based games on Android. The structure is that of a standard Android Studio project, with the main exploit logic in 'MainActivity.java' and a native payload in 'libpreinitv2/preinit.c'. The exploit works by allowing the user to specify the package name of a Unity app installed on the device. It then attempts to launch the Unity app with a special intent that causes the app to load the attacker's native library (libpreinit.so). When loaded, this library executes code (via its constructor) that sends a broadcast intent back to the PoC app, confirming successful code execution. The exploit is designed to test for arbitrary code execution vulnerabilities in Unity's Android runtime, specifically the ability to load attacker-controlled native libraries into another app's process. The repository includes build scripts, Android resources, and test files, but the core exploit logic is in the Java and C files. No network endpoints are involved; the attack vector is local, requiring the attacker to have the ability to install and run apps on the target device.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
139 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Meta Quest device vulnerability allowing a malicious installed application to manipulate Unity applications to achieve arbitrary code execution.
A vulnerability in Unity for Android and Windows, listed as a trending CVE for the week. No further details provided.
A vulnerability in the Unity game engine (CVE-2025-59489) allows malicious apps on the same device to inject command-line arguments into Unity-based games, potentially loading malicious code. It primarily affects Android but may also impact other platforms and, in rare cases, can be exploited remotely.
A vulnerability in the Unity game engine that allows malicious apps to inject command-line arguments into Unity-based games, potentially loading malicious code. Impacts Android and possibly other platforms, with some remote exploitation scenarios possible.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.