CVE-2025-64723

Medium CVSS: 4.8

Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS was configured with overly permissive security entitlements that could bypass macOS Hardened Runtime protections. This configuration allows attackers to inject malicious dynamic libraries into the application process, gaining access to all TCC (Transparency, Consent, and Control) permissions granted to the application. The fix is included starting from the `2.3.7 ` release.

Vendor

Arduino

Product

Arduino Ide

CWE

CWE-276

Yayın Tarihi

2025-12-18 16:15:55

Güncelleme

2026-02-19 21:22:21

Source Identifier

security-advisories@github.com

KEV Date Added

Kategoriler

CWE-276 Arduino Ide MEDIUM Arduino 2025

Referanslar

https://github.com/arduino/arduino-ide/commit/1fa0fd31c8d6b62f19332e33713a8c5b0f4ed6f9 https://github.com/arduino/arduino-ide/pull/2805 https://github.com/arduino/arduino-ide/releases/tag/2.3.7 https://github.com/arduino/arduino-ide/security/advisories/GHSA-vf5j-xhwq-8vqj https://support.arduino.cc/hc/en-us/articles/24329484618652-ASEC-25-004-Arduino-IDE-v2-3-7-Resolves-Multiple-Vulnerabilities