What’s Vulnerable › Vulnerabilities

CVE-2019-9197

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-12-31 · updated 2026-06-17
• Weakness: CWE-78

Description

The com.unity3d.kharma protocol handler in Unity Editor 2018.3 allows remote attackers to execute arbitrary code.

Affected products

• Unity3D Unity Editor: from 5.6.0 before 5.6.7f1; from 2017.4.22 before 2017.4.22f1; from 2018.2.21 before 2018.2.21f1; from 2018.3.7 before 2018.3.7f1; from 2019.1.0 before 2019.1.0b5; from 2019.2.0 before 2019.2.0a7 — fixed in 2017.4.22f1, 2018.2.21f1, 2018.3.7f1, 2019.1.0b5, 2019.2.0a7, 5.6.7f1

How to fix

Upgrade to a fixed version: Unity3D Unity Editor 2017.4.22f1, 2018.2.21f1, 2018.3.7f1, 2019.1.0b5. Check the vendor advisory for mitigations.

References

• https://unity3d.com/security#CVE-2019-9197
• https://www.zerodayinitiative.com/advisories/ZDI-19-252/
• https://unity3d.com/security#CVE-2019-9197
• https://www.zerodayinitiative.com/advisories/ZDI-19-252/

Get alerted when CVE-2019-9197 or the next vulnerability affects your stack