Dozens of games removed from Steam due to Unity engine vulnerability

A critical vulnerability has been discovered in the Unity game engine, which remained unnoticed for more than 10 years and affected all versions starting from Unity 2017.1 and up to the new Unity 6. Due to the problem, dozens of games have temporarily disappeared from Steam, including Fallout Shelter, Grounded 2, Pentium, and other games that used Unity’s auxiliary modules (for example, digital artbooks or companion apps).

According to Unity, the vulnerability in the Runtime component could allow attackers to download malicious files or access local user data. Windows, MacOS, Linux, and Android are at risk. The danger is especially great if the game is launched with administrator rights.

Developers began to quickly remove games from Steam until fixes are released. Obsidian Entertainment was the first to react, removing Grounded 2, Pentium, Avowed, and Pillars of Eternity.

Unexpectedly, the problem even affected games on the Unreal Engine: for example, the artbook of Avowed was affected, and Starfield and Oblivion Remastered had additional applications created on Unity.

In the list of “dangerous” games:

• Fallout Shelter
• Wasteland Remastered
• Wasteland 3
• Pillars of Eternity 2: Deadfire
• The Elder Scrolls: Blades
• The Elder Scrolls: Castles
• Hearthstone
• Warcraft Rumble and others.

Some titles have already received updates (Marvel Snap, No Rest for the Wicked, Ingress, Fate/Grand Order, Persona 5: The Phantom X, Overcooked! 2). Some indie teams have released patches under the Unity security update label.

Unity claims that no real attacks have been recorded yet, but advises users to be careful and, if necessary, temporarily remove vulnerable games until security updates are released.