31–33 of 33 posts
I don't understand the threat model of this for most Unity games on PC, it doesn't seem like there's anything you could do by running arbitrary code inside the Unity player that you couldn't already run on your PC directly or access via the process's memory, etc?
> This vulnerability allows malicious intents to control command line arguments passed to Unity applications, enabling attackers to load arbitrary shared libraries (.so files) and execute malicious code, depending on the platform. Aren't intents an Android-only thing? I'm not sure adding "depending on the platform" makes sense when the exploit only works on a single platform.
The biggest impact is for Android. The official advisory from Unity https://unity.com/security/sept-2025-01 lists that for desktop platforms it's more of privilege escalation instead of code execution. On windows if the game has been registered as custom URL scheme handler it opens ways for triggering it without ability to pass custom CLI arguments. On macOS as part of application signing macOS apps also contain perm…
Applications may have permission to access files/services that other apps and even root (I believe) would need user-prompt access to, gated by TCC (potentially including sandboxed game’s data).
Code signed games that opt into enabling library validation should prevent the issue of loading arbitrary code, however many games likely don’t do this.
https://unity.com/security/sept-2025-01/remediation explains these details fairly well in macOS section
Earlier quoted context omitted.
"It's opensource, so people would likely have caught this issue." Lol, practically every CVE is on code you can read. "It's opensource, so it is going to be a better engine in the long run." Citation needed.
> "practically every CVE is on code you can read." This is probably true due to a sort of survivorship bias. code you can read is much easier to analyze and test and report. Closed source internal code has a lot of security by obscurity built into it. Not to dismiss security by obscurity, I am sure it keeps an absolute frightening amount of code safe.
“The oldest and strongest emotion of mankind is fear, and the oldest and strongest kind of fear is fear of the unknown.” H.P. Lovecraft