A few days ago, Unity disclosed a remote code execution (RCE) vulnerability which was impacting versions dating back to 2017. This effectively meant that almost all games and apps that use Unity 2017.1 are vulnerable to attacks from malicious actors. Although Unity has already released patches in the latest version of its software, Microsoft has recently published a separate advisory since many of its apps and services are affected too.
The issue in question is being publicly tracked as CVE-2025-59489 and it has been assigned a CVSS severity score of 8.4/10, which is pretty high. Microsoft says that it is currently evaluating how many apps and games developed and published by the firm are impacted by the vulnerability, and is in the process of rolling out updates for all of them.
Microsoft has emphasized that Unity software downloaded on Windows, Android, Linux, and macOS is affected. However, customers using consoles, cloud gaming, and iOS should consider themselves safe. Importantly, Microsoft Mesh is impacted too, since it uses Unity as well. Customers utilizing Mesh should update to the latest version of the software, and while this shouldn"t affect previously scheduled events, Redmond has suggested updating Mesh apps before joining a meeting just to avoid any undue disruption.
The following Microsoft apps and games have been confirmed as impacted by the Unity vulnerability, and updates are being rolled out for them:
- Microsoft Mesh PC Applications
- Pillars of Eternity
- Hearthstone
- Grounded 2 Artbook
- Zoo Tycoon Friends
- The Elder Scrolls: Legends
- Mighty Doom
- Halo Recruit
- Gears POP!
- Forza Customs
- DOOM II (2019)
- DOOM (2019)
- Wasteland Remastered
- Wasteland 3
- Warcraft Rumble
- The Elder Scrolls: Castles
- The Elder Scrolls: Blades
- The Elder Scrolls IV: Oblivion Remastered Companion App
- The Bard"s Tale Trilogy
- Starfield Companion App
- Pillars of Eternity: Hero Edition
- Pillars of Eternity: Definitive Edition
- Pillars of Eternity II: Deadfire - Ultimate Edition
- Pillars of Eternity II: Deadfire
- Knights and Bikes
- Ghostwide Tokyo Prelude
- Fallout Shelter
- DOOM: Dark Ages Companion App
- Avowed Artbook
If you don"t see your game listed above, you still have nothing to worry about as long as you have installed all available updates. However, if no recent update is being shown to you, you are advised to uninstall the game a patch is made available. You can find more details here.