"Searching for libunity.so" "Patch Not Needed"

Q&A for CVE-2025-59489
,
1

Is there a way to see what version of Unity the AAB/APK is made with using the patcher GUI? (or another method).
I am getting patch not needed, not sure what 2017 version I made the games with.
I currently have 2017.4 LTS installed, but do not want to rebuild if possible.

Am I to presume if “Patch Not Needed” Is shown in the Application Patcher, I got lucky with that particular app for now and can ignore?

2

Yes, this particular message means your app is not vulnerable.

To determine the version, find the data.unity3d or the globalgamemanagers` file inside your application and open it in a hex editor. The Unity version string will be there in the first 50 bytes or so.

3

Thanks, found out its using : 2017.4.40f1
Which is indeed the latest 2017 version, and amongst the affected versions listed here: https://security-patches.unity.com/bc0977e0-21a9-4f6e-9414-4f44b242110a/affected_versions.txt

It should trigger patch needed right?
Is this a bug in the patch detection, or latest 2017 is actually safe (for android), open to suggestions :smiley:

  • Finding the version of unity player used
    1. Rename your apk file extension to rar (an APK is just a RAR file)
    1. Extract the file’s contents.
    1. Open any numbered asset file inside: assets/bin/Data with your hex editor.
4

If you are using IL2CPP scripting backend then you are safe. Before 2019.1 only Mono apps are vulnerable.