CVEvulnerability
CVE-2025-64723
4.8 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2025-12-18
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 4.8 MEDIUM — CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 4.4 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weaknesses
- CWE-276
Description
Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS was configured with overly permissive security entitlements that could bypass macOS Hardened Runtime protections. This configuration allows attackers to inject malicious dynamic libraries into the application process, gaining access to all TCC (Transparency, Consent, and Control) permissions granted to the application. The fix is included starting from the `2.3.7 ` release.
Affected configurations
• arduino arduino ide (< 2.3.7)
Related
Weakness · CWE (1)
- CWE-276 Incorrect Default Permissions weakness
References
- https://github.com/arduino/arduino-ide/commit/1fa0fd31c8d6b62f19332e33713a8c5b0f4ed6f9 Patch
- https://github.com/arduino/arduino-ide/pull/2805 Issue Tracking
- https://github.com/arduino/arduino-ide/releases/tag/2.3.7 Product, Release Notes
- https://github.com/arduino/arduino-ide/security/advisories/GHSA-vf5j-xhwq-8vqj Patch, Vendor Advisory
- https://support.arduino.cc/hc/en-us/articles/24329484618652-ASEC-25-004-Arduino-IDE-v2-3-7-Resolves-Multiple-Vulnerabilities Vendor Advisory