Support NeoGAF

[Miyazaki’s Slave]

AKA, nightmare fuel for developers especially heading into a weekend!

No details on what the security vulnerability is inside of their warning emails but I can say I do not remember ever getting one of these from Unity over the last 15 years.

Sorry for the wack formatting...

********************

An important message​

A security vulnerability was identified that affects games and applications built on Unity versions 2017.1 and later for Android, Windows, Linux, and macOS operating systems. There is no evidence of any exploitation of the vulnerability, nor has there been any impact on users or customers. We have proactively provided fixes that address the vulnerability, and they are already available to all developers. The vulnerability was responsibly reported by the security researcher RyotaK, and we thank him for working with us.

Key Facts:​

• There is no evidence of any exploitation of the vulnerability nor has there been any impact on users or customers.
• Unity has worked in close collaboration with our platform partners who have taken further steps to secure their platforms and protect end users.
• Released games or applications using Unity 2017.1 or later for Windows, Android, macOS, or Linux may contain this vulnerability.
• Unity has released an update for each of the major and minor versions of the Unity Editor starting with Unity 2019.1.
• Unity has released a binary patcher to patch already-built applications dating back to 2017.1.

What Actions Should You Take?​

You need to take action if you have developed and released a game or application using Unity 2017.1 or later for Windows, Android, or macOS. It is imperative that you review the following guidance to ensure the continued safety of your users.

• If your project is still in active development:
  
  • Download the patched update for your version of the Unity Editor, available via Unity Hub or the Unity Download Archive, before building and publishing. This will ensure that your releases are fully protected.
  • We strongly recommend you download the patched update for your version of the Unity Editor, recompile, and republish your application.
  • We have provided a tool to patch already-built applications dating back to 2017.1 for Android, Windows, and macOS for developers who prefer not to rebuild their projects. The tool can be accessed here.

Additional Platforms:​

• For Horizon OS: Meta devices have implemented mitigations so that vulnerable Unity apps running on Horizon OS cannot be exploited.
• For Linux: The vulnerability presents a much lower risk on Linux compared to Android, Windows, and macOS.
• For all other Unity-supported platforms, including iOS, there have been no findings to suggest that the vulnerability is exploitable.
• For the best protection, we always recommend you are on the latest patch release of the version of Unity you are using.

Consumer Guidance:​

• There is no evidence of any exploitation of the vulnerability nor has there been any impact on users or customers.
• Advise your users to keep their devices and applications updated, enable automatic updates, and maintain current antivirus software.
• Encourage security best practices, including avoiding suspicious downloads and routinely updating all software.

Our Commitment: Unity is dedicated to the security and integrity of our platform, our customers, and the wider community. Transparent communication is central to this commitment, and we will continue to provide updates as necessary.
For comprehensive technical details, please consult our patching tool and remediation guide, Security Advisory, and CVE-2025-59489. If you have any questions, join us in Discussions or if you need additional support you can open up a ticket at support.unity.com.
Please also consult our FAQ.

Your proactive attention to this matter is essential to protect your users and allow you to uphold the highest standards of security.​

​

 

[RoboFu]

lol I'm using the dark theme and it's basically a blank page.

 

[Wolzard]

 

[Miyazaki’s Slave]

lol I'm using the dark theme and it's basically a blank page.

Yeah, I fixed that on my end. Well...it looks fixed (I am also in dark mode).

Spoiler: Patched Post...thanks Unity.

 

[IAmRei]

thanks for the info

 

[adamsapple]

Somehow this is Unreal Engine 5's fault.

 

[Magic Carpet]

iOS? Does this mean a bad actor can get into my bank account and drain me dry?

 

[Kilau]

Somehow this is Unreal Engine 5's fault.

Why would you or anybody not paid by Epic... ADAM!

 

[simpatico]

Painted finger nails attached to hairy knuckles coded this….

 

[Holammer]

Saw Stunlock Studios tweet about it. Battlerite/V Rising They are working on V Rising patch.

 

[Gordon Fearman]

No details on what the security vulnerability is inside of their warning emails but I can say I do not remember ever getting one of these from Unity over the last 15 years.

Probably this.

 

[yurinka]

Holy fuck, 2017.1 is a super old version. This basically includes almost all Unity projects that are now being sold. To patch this pretty likely is going to be a big pain in the ass for many people.

 

[Miyazaki’s Slave]

Holy fuck, 2017.1 is a super old version. This basically includes almost all Unity projects that are now being sold. To patch this pretty likely is going to be a big pain in the ass for many people.

Been up since 4:15 my time trying to do JUST that.

It is a GIGANTIC pain in the ass especially when you have to deal with enterprise apps.

 

[GrayChild]

Our lord and savior Gaben has released a new Steam version which includes a wrapper protecting from this vulnerability:

Steam :: Steam News :: Steam Client Update - October 2nd

A new Steam client has been released and will be automatically downloaded. General Added mitigations for Unity CVE-2025-59489, blocking a game launch through the Steam Client when an exploit attempt is detected. Added "End of Life" alert for 32-bit versions of Windows. Currently Windows 10...

steamcommunity.com

Make sure to update your Steam, people!

 

[Itchy Tickles]

Does Valve charge to put up patches separately from their 30%? I thought I remember something during the ps3 or ps4 era, that it would cost devs like 20k a patch. If that's the case, is Unity going to pay for it? Again, I might be misremembering things.

 

[Miyazaki’s Slave]

Does Valve charge to put up patches separately from their 30%? I thought I remember something during the ps3 or ps4 era, that it would cost devs like 20k a patch. If that's the case, is Unity going to pay for it? Again, I might be misremembering things.

Steam does not charge for patch releases.

Back in the day on consoles you would get a certain amount of patches included with the cost of your certification fees. Outside of those, yes, it was an additional cost.

Now most of that is automated depending on the platform.

 

[TintoConCasera]

Good afternoon to all my fellow Godot chads out there, hope you have a beautiful day.

 

[YeulEmeralda]

Who the hell is going to patch old dormant games that don't make any money?

 

[Kataploom]

Our lord and savior Gaben has released a new Steam version which includes a wrapper protecting from this vulnerability:

Steam :: Steam News :: Steam Client Update - October 2nd

A new Steam client has been released and will be automatically downloaded. General Added mitigations for Unity CVE-2025-59489, blocking a game launch through the Steam Client when an exploit attempt is detected. Added "End of Life" alert for 32-bit versions of Windows. Currently Windows 10...

steamcommunity.com

Make sure to update your Steam, people!

Oh, Steam makes sure to update itself all the time, it's unescapable lol