QwikSec

Security Database

CVE

CWE

Training

CVE-2025-64723

Published: Dec 18, 2025

Modified: Jan 14, 2026

PUBLISHED

Description

Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS was configured with overly permissive security entitlements that could bypass macOS Hardened Runtime protections. This configuration allows attackers to inject malicious dynamic libraries into the application process, gaining access to all TCC (Transparency, Consent, and Control) permissions granted to the application. The fix is included starting from the `2.3.7 ` release.

Vendor	Product	Versions
arduino	arduino-ide	affected `< 2.3.7`

Weaknesses (CWE)

References

https://github.com/arduino/arduino-ide/security/advisories/GHSA-vf5j-xhwq-8vqj

x_refsource_CONFIRM

https://github.com/arduino/arduino-ide/pull/2805

x_refsource_MISC

https://github.com/arduino/arduino-ide/commit/1fa0fd31c8d6b62f19332e33713a8c5b0f4ed6f9

x_refsource_MISC

https://github.com/arduino/arduino-ide/releases/tag/2.3.7

x_refsource_MISC

https://support.arduino.cc/hc/en-us/articles/24329484618652-ASEC-25-004-Arduino-IDE-v2-3-7-Resolves-Multiple-Vulnerabilities

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.