Usually yes, or you apply the vendor's binary patch. A game embeds the engine runtime at build time, so updating the editor on a developer machine does not change builds already in players' hands. Unity's advisory for CVE-2025-59489 is a clear example of this pattern.
What the advisory says
Unity's advisory classifies CVE-2025-59489 as CWE-426, Untrusted Search Path, with High severity and a CVSS score of 8.4. It was reported by RyotaK of GMO Flatt Security, and patches were available on 2 October 2025. The advisory states that applications built with the indicated editor versions prior to the patched versions are considered vulnerable. It lists patched versions such as 6000.0.58f2 for the 6000.0 LTS line and 2022.3.67f2 for 2022.3, and says fixes were extended to out of support versions from 2019.1 onward. It lists no patch for 2018.4 and earlier or the 2017.x builds.
It also states there is no evidence of exploitation and no impact on users or customers.
The two remediation paths
Per the advisory:
- Rebuild. Update the Unity Editor to the newest version, then rebuild and redeploy the application.
- Binary patch. Unity provides a platform specific Binary Patch tool that replaces the runtime library with a patched version.
The advisory lists Android, Windows, Linux (desktop and embedded) and macOS as potentially affected platforms. On Windows it notes that a registered custom URI handler for a vulnerable application may increase exploitation risk.
A plan for any engine advisory
- Find every shipped build. Games often have several live versions across platforms and stores. Make a list.
- Match each to an engine version. The editor version used for the build is the key fact.
- Choose rebuild or patch per title. A game in active development is a rebuild. A frozen older title may suit a patch tool, if it works with your setup.
- Test the patched build. Check behavior that depends on anti tamper or custom launchers.
- Ship and confirm. Push through each store and check that the new version is live.
- Record it. Keep the version, date and decision for each title.
Reduce exposure while you wait
If your game registers a custom URI handler, review what arguments it accepts and what it hands to the engine. A small input check at the entry point is cheap compared with a wide exposure.
Try it yourself
The demo shows how a new disclosure is tracked against software you already run. Click through it, then ask whether you could answer "which of our builds embed this engine version" in an hour.
Click through it at your own pace, or open it full screen.
Quick check
Is updating my editor enough?
No. The vulnerable runtime is inside builds you already shipped. You need to rebuild and redeploy, or use the vendor's patch tool, per the advisory.
Is this advisory confirmed as exploited?
The advisory states there is no evidence of exploitation. That can change, so check the vendor page for updates.
Safeguard's SBOM and dependency scanning helps you keep a list of what each shipped build contains. A free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
