p3x.de
A code execution security vulnerabilty has been identified in all games built with Unity 2017 and later
Mikinahttps://unity.com/security/sept-2025-01/remediation
Unity has been sounding the alarm about a code execution vulnerability that has been identified in all applications built with vulnerable editor.
EDIT: While the below text kind of still holds for Desktops, I’ve absolutely forgotten about Android. If you have an Android game, you should definitely patch, since the situation is kind of different there.
Also, if your game is registered as custom URL schema handler, it can lead to privlidge escalation, or maybe even be triggered remotely (through a malicious link), so Update.
While there’s definitely no harm in patching, in my personal opinion, the situation is needlessly overblown. I have worked in offensive cybersecurity, and the fact that Unity game allows you to locally run a code that
would be confined to the privilege level of the vulnerable application, and information disclosure would be confined to the information available to the vulnerable application.
is not really exploitable. Since the attack vector is local, the attacker already has to have read/write/execute access to the application and your system, which usually means you have way bigger problems.
Not to mention that since Unity suffers with .dll injection vulnerability (which is what most mods are using), the attacker can do the same by simply replacing a .dll file of the game.
So, patch up if you can, but if you’re not able or can’t be bothered, in my opinion, it doesn’t really matter. But please prove me if I’m wrong.
Share on Mastodon
Share on Reddit
Share on WhatsApp7 Comments
Comments from other communities
Some Unity games may be launched with a parameter that causes them to execute arbitrary code. It seems like it only makes sense on Android. Windows and Linux games can normally only be launched by a process with the same or greater privileges than the process being created, but on Android you can elevate privileges by invoking another app. In practical terms, another app can access the save data of your mobile games.
There was also something about games that register to be launchable directly from a webpage, which would allow web sites to escape the browser sandbox, but it didn’t sound likely.
tallooks
For Linux, my off-the-cuff take is that I’m not that excited about it. It means that if you can launch a Unity game and pass it command-line arguments, then you can cause it to take actions that you want. Okay, but usually the security context of someone who can do that and the game that’s running should probably be the same. If you can launch a game with specified parameters to do something bad, you can probably also just do something bad and cut the game out of the picture.
This is why you have few suid binaries on a Limux system (and should never make something large and complex, like a Unity game, suid) — because then the binary does have a different security context than the launching process.
Now, it’s possible that there are scenarios where you could make this badly exploitable. Say games have chosen to trust command-line arguments from a remote system, and that game has community servers. Like, maybe they have a lobby app that launches a Unity binary with remotely-specified command line arguments. But in that case, I think that the developer is already asking for trouble.
Most games are just not going to be sufficiently hardened to avoid problems if an attacker can pass arbitrary command lines anyway. And as the bug points out, on Linux, you can achieve something similar to this for many binaries via using LD_PRELOAD anyway — you can use that route to make fixes for closed-source Linux games. Windows has similar routes, stuff like DLL injection.
It’s possible that this is more serious on Android. I don’t know if there’s a way to pass command line parameters there, and doubt it, but part of the Android security model is that apps run in isolation, and so if that’s exploitable by any local app, that could cause that model to break down.
But on Linux — GNU/Linux — I’d think that if someone malicious can already launch games with arbitrary command line parameters on your system, you’re probably not really in much worse trouble due to this bug than you already are.
This is a pretty big deal and should be patched, but it’s not the worst case scenario. The worst case scenario would be if an attacker could do this remotely through your game.
Basically, if someone has the ability to change the shortcut on an end machine to specify additional arguments, your game could be used to run malicious code on that machine under the guise of your game, making detection harder.
The benefit is that modifying a shortcut is not an easy thing to do without tricking the user, or using an already established remote control of the endpoint.
However, this is still a vulnerability and one that should have a minimal impact if it were patched. You should install this patch if you make games with Unity.
ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FAEFB6177B4672DEE07F9D3AFC62588CCD2631EDCF22E8CCC1FB35B501C9C86
Apparently the biggest risk is that another malicious application could modify the intent urls of the runtime to pass extra arguments to the command line and run arbitrary code whenever you start a unity game. Apparently permissions could be escalated on windows but only if you registered the app as a custom URL schema handler
It’s an easy attack vector to drain crypto wallets!
I didn’t want to take any Risks. So did the fix first thing in the morning and had QAs doing tests all morning. Pushed the fixed build after lunch. The fix was really simple with a Unity made tool. It was actually clear and understandable, unlike the messes Unity usually ships.
LOL yeah, they took this seriously and handled it well
I see, but still - how is that different from a regular old .dll injection? Or, just replacing the .exe alltogether.
If you’re at the point of R/W/X on a machine, then you have a lot of similar vectors of attack.
That is, assuming there’s no privilege escalation, which the vuln report does not mention.
The attack is through other unrelated apps that get installed, so if some shitty todo app gets compromised the rest of the games that use the unpatched runtime can be targeted. Yes, the risks are probably pretty minimal, but app permissions on android are not well-known for their sensibility.
Also on windows:
Interesting, can you pass arbitrary command line arguments via a URL like that on Windows? If so, this could be catastrophic if all you need is a malicious link on any website to trigger it.
Honestly, I am pretty shocked at how simple and easy it was to apply the patch. Kinda surprising from the Unity team, but a welcome surprise, to be sure.