CVE-2025-64723: arduino ide

csirt@kutim:~/threat-intel/cve/CVE-2025-64723

CVSS 4.4 · Medium EPSS 0,13%

Kerentanan Incorrect Default Permissions pada arduino ide. Skor CVSS 3.1 4.4 (Medium) menurut NVD.

Deskripsi (NVD)

Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS was configured with overly permissive security entitlements that could bypass macOS Hardened Runtime protections. This configuration allows attackers to inject malicious dynamic libraries into the application process, gaining access to all TCC (Transparency, Consent, and Control) permissions granted to the application. The fix is included starting from the `2.3.7 ` release.

Rincian

Terbit di NVD: 18 Desember 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 4.4 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-276: Incorrect Default Permissions
EPSS (30 hari): 0,13% peluang dieksploitasi; lebih tinggi dari 2,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
arduino	arduino ide	Semua versi sebelum 2.3.7

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/arduino/arduino-ide/security/advisories/GHSA-vf5j-xhwq-8vqj patch · advisory vendor
https://support.arduino.cc/hc/en-us/articles/24329484618652-ASEC-25-004-Arduino-IDE-v2-3-7-Resolves-Multiple-V... advisory vendor
https://github.com/arduino/arduino-ide/commit/1fa0fd31c8d6b62f19332e33713a8c5b0f4ed6f9 patch
https://github.com/arduino/arduino-ide/pull/2805 issue tracking
https://github.com/arduino/arduino-ide/releases/tag/2.3.7 product · release notes

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.