Unity released fixes on October 2, 2025 for CVE-2025-59489, a high-severity vulnerability affecting applications built with vulnerable versions of the Unity Editor. The company’s security advisory described unsafe file loading that could permit code execution or information disclosure within an affected application’s privileges.
The distinction matters for crypto users: the presence of a vulnerable game or application is not, by itself, evidence that a wallet has been accessed or funds stolen.
What Unity disclosed
The advisory assigned the issue a CVSS score of 8.4 and credited RyotaK of GMO Flatt Security with discovering it. Exposure depended on the operating system and application build.
Unity said its investigation had found no evidence of exploitation or impact on users and customers. That statement describes the vendor’s reported findings; it does not mean every application was automatically updated.
Updating affected applications
Developers should use the vendor’s affected-version tables and remediation instructions to identify builds requiring an update. End users depend on application publishers to distribute repaired versions.
The advisory supports reporting a software vulnerability. It does not support describing a confirmed cryptocurrency theft campaign.
Editor’s note: The headline and body now distinguish potential software exposure from confirmed wallet compromise and identify the vendor’s official remediation guidance.