Vulnerability · Published Dec 18, 2025 · Assigned by GitHub_M

CVE-2025-64724Arduino IDE for macOS has Insecure File Permissions

Medium 4.8

In plain English

A medium-severity incorrect default permissions in arduino-ide from arduino. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 4.0)4.8Medium

Exploit odds (30 days)0.1%top 97.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS is installed with world-writable file permissions on sensitive application components, allowing any local user to replace legitimate files with malicious code. When another user launches the application, the malicious code executes with that user's privileges, enabling privilege escalation and unauthorized access to sensitive data. The fix is included starting from the `2.3.7` release.

Affected products (as reported)

Vendor	Product	Versions
arduino	arduino-ide	< 2.3.7

Weakness: CWE-276 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://github.com/arduino/arduino-ide/security/advisories/GHSA-3fvj-pgqw-fgw6 x_refsource_CONFIRM
https://github.com/arduino/arduino-ide/pull/2805/commits/5d282f38496e96dcba02818536c0835bd684ec98 x_refsource_MISC
https://github.com/arduino/arduino-ide/releases/tag/2.3.7 x_refsource_MISC
https://support.arduino.cc/hc/en-us/articles/24329484618652-ASEC-25-004-Arduino-IDE-v2-3-7-Resolves-Multiple-Vulnerabilities x_refsource_MISC