Loading vulnerability…
CVE-2025-59489 is a high-severity vulnerability in Unity Runtime affecting applications built with vulnerable Unity Editor versions and deployed on Android, Windows, macOS, and Linux. The flaw is caused by improper handling of command-line arguments, specifically the -xrsdk-pre-init-library parameter, which can be influenced by an attacker to make a Unity application load native library code from an unintended location. This creates an untrusted search path condition and arbitrary library loading scenario. On Android, the issue is associated with Unity’s debugging-related handling of externally supplied arguments through the default exported application entry point, allowing another local application to influence runtime parameters. On Windows, exploitation may also be possible in narrower remote scenarios when a vulnerable application exposes an invokable custom URI handler. Successful exploitation can result in arbitrary code execution and access to information available to the targeted Unity application. Because the vulnerable logic resides in the runtime embedded into built applications, remediation generally requires rebuilding and redeploying affected applications rather than only updating the editor installation.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository is a Proof-of-Concept (PoC) exploit for CVE-2025-59489, targeting Unity-based games on Android. The structure is that of a standard Android Studio project, with the main exploit logic in 'MainActivity.java' and a native payload in 'libpreinitv2/preinit.c'. The exploit works by allowing the user to specify the package name of a Unity app installed on the device. It then attempts to launch the Unity app with a special intent that causes the app to load the attacker's native library (libpreinit.so). When loaded, this library executes code (via its constructor) that sends a broadcast intent back to the PoC app, confirming successful code execution. The exploit is designed to test for arbitrary code execution vulnerabilities in Unity's Android runtime, specifically the ability to load attacker-controlled native libraries into another app's process. The repository includes build scripts, Android resources, and test files, but the core exploit logic is in the Java and C files. No network endpoints are involved; the attack vector is local, requiring the attacker to have the ability to install and run apps on the target device.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
140 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Meta Quest device vulnerability allowing a malicious installed application to manipulate Unity applications to achieve arbitrary code execution.
A vulnerability in Unity for Android and Windows, listed as a trending CVE for the week. No further details provided.
A vulnerability in the Unity game engine (CVE-2025-59489) allows malicious apps on the same device to inject command-line arguments into Unity-based games, potentially loading malicious code. It primarily affects Android but may also impact other platforms and, in rare cases, can be exploited remotely.
A vulnerability in the Unity game engine that allows malicious apps to inject command-line arguments into Unity-based games, potentially loading malicious code. Impacts Android and possibly other platforms, with some remote exploitation scenarios possible.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.