CVE-2025-64723

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-64723

4.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 2.5

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

A

rduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS was configured with overly permissive security entitlements that could bypass macOS Hardened Runtime protections. This configuration allows attackers to inject malicious dynamic libraries into the application process, gaining access to all TCC (Transparency, Consent, and Control) permissions granted to the application. The fix is included starting from the `2.3.7 ` release.

References
Link Resource
https://github.com/arduino/arduino-ide/commit/1fa0fd31c8d6b62f19332e33713a8c5b0f4ed6f9 Patch
https://github.com/arduino/arduino-ide/pull/2805 Issue Tracking
https://github.com/arduino/arduino-ide/releases/tag/2.3.7 Product Release Notes
https://github.com/arduino/arduino-ide/security/advisories/GHSA-vf5j-xhwq-8vqj Patch Vendor Advisory
https://support.arduino.cc/hc/en-us/articles/24329484618652-ASEC-25-004-Arduino-IDE-v2-3-7-Resolves-Multiple-Vulnerabilities Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:arduino:arduino_ide:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
History

19 Feb 2026, 21:22

Type Values Removed Values Added
First Time Arduino arduino Ide
Arduino
Apple macos
Apple
References () https://github.com/arduino/arduino-ide/commit/1fa0fd31c8d6b62f19332e33713a8c5b0f4ed6f9 - () https://github.com/arduino/arduino-ide/commit/1fa0fd31c8d6b62f19332e33713a8c5b0f4ed6f9 - Patch
References () https://github.com/arduino/arduino-ide/pull/2805 - () https://github.com/arduino/arduino-ide/pull/2805 - Issue Tracking
References () https://github.com/arduino/arduino-ide/releases/tag/2.3.7 - () https://github.com/arduino/arduino-ide/releases/tag/2.3.7 - Product, Release Notes
References () https://github.com/arduino/arduino-ide/security/advisories/GHSA-vf5j-xhwq-8vqj - () https://github.com/arduino/arduino-ide/security/advisories/GHSA-vf5j-xhwq-8vqj - Patch, Vendor Advisory
References () https://support.arduino.cc/hc/en-us/articles/24329484618652-ASEC-25-004-Arduino-IDE-v2-3-7-Resolves-Multiple-Vulnerabilities - () https://support.arduino.cc/hc/en-us/articles/24329484618652-ASEC-25-004-Arduino-IDE-v2-3-7-Resolves-Multiple-Vulnerabilities - Vendor Advisory
CPE cpe:2.3:a:arduino:arduino_ide:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.4

14 Jan 2026, 17:16

Type Values Removed Values Added
References
  • {'url': 'https://github.com/arduino/arduino-ide/pull/2805/commits/2f7667136ee95ce07dde23c49d2de526b45e3293', 'source': '[email protected]'}
  • () https://github.com/arduino/arduino-ide/commit/1fa0fd31c8d6b62f19332e33713a8c5b0f4ed6f9 -
  • () https://github.com/arduino/arduino-ide/pull/2805 -

19 Dec 2025, 18:00

Type Values Removed Values Added
New CVE
Information

Published : 2025-12-18 16:15

Updated : 2026-02-19 21:22

NVD link : CVE-2025-64723

Mitre link : CVE-2025-64723

CVE.ORG link : CVE-2025-64723

JSON object : View

Products Affected

apple

arduino

CWE
CWE-276

Incorrect Default Permissions