CVE-2025-64723

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-64723
Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS was configured with overly permissive security entitlements that could bypass macOS Hardened Runtime protections. This configuration allows attackers to inject malicious dynamic libraries into the application process, gaining access to all TCC (Transparency, Consent, and Control) permissions granted to the application. The fix is included starting from the `2.3.7 ` release.

4.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 2.5

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/arduino/arduino-ide/commit/1fa0fd31c8d6b62f19332e33713a8c5b0f4ed6f9 Patch
https://github.com/arduino/arduino-ide/pull/2805 Issue Tracking
https://github.com/arduino/arduino-ide/releases/tag/2.3.7 Product Release Notes
https://github.com/arduino/arduino-ide/security/advisories/GHSA-vf5j-xhwq-8vqj Patch Vendor Advisory
https://support.arduino.cc/hc/en-us/articles/24329484618652-ASEC-25-004-Arduino-IDE-v2-3-7-Resolves-Multiple-Vulnerabilities Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:arduino:arduino_ide:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
History

19 Feb 2026, 21:22

Type Values Removed Values Added
References () https://github.com/arduino/arduino-ide/commit/1fa0fd31c8d6b62f19332e33713a8c5b0f4ed6f9 - () https://github.com/arduino/arduino-ide/commit/1fa0fd31c8d6b62f19332e33713a8c5b0f4ed6f9 - Patch
References () https://github.com/arduino/arduino-ide/pull/2805 - () https://github.com/arduino/arduino-ide/pull/2805 - Issue Tracking
References () https://github.com/arduino/arduino-ide/releases/tag/2.3.7 - () https://github.com/arduino/arduino-ide/releases/tag/2.3.7 - Product, Release Notes
References () https://github.com/arduino/arduino-ide/security/advisories/GHSA-vf5j-xhwq-8vqj - () https://github.com/arduino/arduino-ide/security/advisories/GHSA-vf5j-xhwq-8vqj - Patch, Vendor Advisory
References () https://support.arduino.cc/hc/en-us/articles/24329484618652-ASEC-25-004-Arduino-IDE-v2-3-7-Resolves-Multiple-Vulnerabilities - () https://support.arduino.cc/hc/en-us/articles/24329484618652-ASEC-25-004-Arduino-IDE-v2-3-7-Resolves-Multiple-Vulnerabilities - Vendor Advisory
First Time Arduino
Apple
Apple macos
Arduino arduino Ide
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.4
CPE cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:a:arduino:arduino_ide:*:*:*:*:*:*:*:*

14 Jan 2026, 17:16

Type Values Removed Values Added
References
  • {'url': 'https://github.com/arduino/arduino-ide/pull/2805/commits/2f7667136ee95ce07dde23c49d2de526b45e3293', 'source': 'security-advisories@github.com'}
  • () https://github.com/arduino/arduino-ide/commit/1fa0fd31c8d6b62f19332e33713a8c5b0f4ed6f9 -
  • () https://github.com/arduino/arduino-ide/pull/2805 -

18 Dec 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-12-18 16:15

Updated : 2026-02-19 21:22

NVD link : CVE-2025-64723

Mitre link : CVE-2025-64723

CVE.ORG link : CVE-2025-64723

JSON object : View

Products Affected

arduino

  • arduino_ide

apple

  • macos
CWE
CWE-276

Incorrect Default Permissions