Unity Discovers Security Vulnerability in Game Engine, Asks Developers to Take 'Immediate Action'

Unity, the widely used game engine, has discovered a security vulnerability that affects games and applications developed on the platform. The company has urged developers to take “immediate action” to protect their games and apps and shared fixes addressing the issue. Unity, however, confirmed that the vulnerability had not been exploited and there had been no impact on users.

The security vulnerability affects all games and apps built on Unity versions 2017.1 and later across Windows, Linux, Android, and macOS, the company said Friday. The vulnerability, discovered by a security researcher, has not yet been exploited. Fixes are available to developers, with Unity rolling out patches to address the vulnerability.

The company has asked developers whose projects are still in active development to download the patched update for the Unity Editor before building and publishing their game to ensure the release is fully protected.

Unity Urges Developers to Implement Updates

For already existing games and apps, Unity has asked developers to download the update, recompile, and republish the application. The company has also provided a tool to patch existing apps dating back to Unity version 2017.1 for Android, Windows, and macOS for developers who do not wish to rebuild their projects.

Developers are now rushing to patch their games, and some have even pulled their titles from online storefronts. On Saturday, The Outer Worlds 2 developer Obsidian said it was temporarily removing some of its games that utilise Unity from digital storefronts. Games removed from online stores include Grounded 2, Avowed, Pillars of Eternity, Pillars of Eternity II: Deadfire, and Pentiment.

“We apologize for any inconvenience this may cause. Our team is working on a fix and will restore these games as soon as possible. We will provide additional information once they are available again. We also encourage players who have already downloaded these games to update them as soon as a patch becomes available,” Obisidian said in a post on X.

For Unity-built games and apps on Android, the company said the OS's built-in malware scanning and other security features would help reduce risks, but a patch update would still be required.

“For Windows-based applications, Microsoft Defender has been updated and will detect and block the vulnerability. Valve will issue additional protections for the Steam client,” Unity added.