Unity warns of security flaw in engine, patches issued for 2017.1+

Unity Technologies has warned developers of a security vulnerability in its game engine that affects projects built with Unity versions 2017.1 and later and can allow third party code to run inside affected applications, company officials said this week. The flaw, tracked as CVE202559489 and assigned a high severity score of 7.4, was disclosed Oct. 2 and has prompted Unity to distribute fixes and a binary patcher so developers can update or rebuild games and apps across Android, Windows, macOS and Linux.

Unity said the bug forces the engine runtime to accept specific preinitialization arguments that can alter where it searches for native libraries. If an attacker already has a malicious app on a device and can influence that search path, a vulnerable Unity app may load and execute the attacker’s native library, running code with the app’s own permissions on Android and creating potential elevation of privilege on desktop platforms. Unity said, "there is no evidence of any exploitation of the vulnerability, nor has there been any impact on users or customers."

Security firms and researchers warn the vulnerability is particularly concerning for applications that embed wallet SDKs...