PT-2025-52245 · Arduino · Arduino Ide

Karmaz95 + 1 · Published 2025-12-18 · Updated 2026-02-19 · CVE-2025-64724

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Arduino IDE versions prior to 2.3.7

Description Arduino IDE for macOS, before version 2.3.7, was installed with overly permissive file permissions on critical application components. This allowed any local user to replace legitimate files with malicious code. When another user launched the application, the malicious code would execute with their privileges, potentially leading to privilege escalation and unauthorized access to sensitive data.

Recommendations Update to version 2.3.7 or later.

Exploit

Fix

LPE

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2025-64724

GHSA-3FVJ-PGQW-FGW6

Affected Products

Arduino Ide

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64724.json · Exploit
• https://github.com/arduino/arduino-ide/pull/2805/commits/5d282f38496e96dcba02818536c0835bd684ec98 · Patch
• https://github.com/arduino/arduino-ide/security/advisories/GHSA-3fvj-pgqw-fgw6 · Vendor Advisory
• https://support.arduino.cc/hc/en-us/articles/24329484618652-ASEC-25-004-Arduino-IDE-v2-3-7-Resolves-Multiple-Vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64724 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64724 · Security Note
• https://github.com/arduino/arduino-ide/releases/tag/2.3.7 · Note
• https://t.me/CVEtracker/40160 · Telegram Post
• https://t.me/cveNotify/152518 · Telegram Post
• https://twitter.com/CVEnew/status/2001728028574179757 · Twitter Post