PT-2025-52244 · Arduino · Arduino Ide

Karmaz95 + 1 · Published 2025-12-18 · Updated 2026-02-19 · CVE-2025-64723

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Arduino IDE versions prior to 2.3.7

Description Arduino IDE for macOS, before version 2.3.7, had overly permissive security entitlements. This configuration bypassed macOS Hardened Runtime protections, allowing attackers to inject malicious dynamic libraries into the application process. Successful exploitation granted attackers access to all Transparency, Consent, and Control (TCC) permissions assigned to the application.

Recommendations Update to version 2.3.7 or later.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2025-64723

GHSA-VF5J-XHWQ-8VQJ

Affected Products

Arduino Ide

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64723.json · Exploit
• https://github.com/arduino/arduino-ide/commit/1fa0fd31c8d6b62f19332e33713a8c5b0f4ed6f9 · Patch
• https://github.com/arduino/arduino-ide/security/advisories/GHSA-vf5j-xhwq-8vqj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64723 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64723 · Security Note
• https://support.arduino.cc/hc/en-us/articles/24329484618652-ASEC-25-004-Arduino-IDE-v2-3-7-Resolves-Multiple-Vulnerabilities · Vendor Advisory
• https://github.com/arduino/arduino-ide/releases/tag/2.3.7 · Note
• https://github.com/arduino/arduino-ide/pull/2805/commits/2f7667136ee95ce07dde23c49d2de526b45e3293 · Note
• https://github.com/arduino/arduino-ide/pull/2805 · Note
• https://twitter.com/VulmonFeeds/status/2001831149778157836 · Twitter Post
• https://t.me/CVEtracker/40159 · Telegram Post
• https://t.me/cveNotify/152517 · Telegram Post
• https://twitter.com/CVEnew/status/2001728030017011867 · Twitter Post