CVE-2025-64723 Arduino IDE for macOS has TCC Bypass via Dynamic Library Injection
Attackers can bypass macOS Hardened Runtime protections to inject libraries and access TCC permissions in Arduino IDE.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-64723?
CVE-2025-64723 is a medium-severity vulnerability in arduino-ide, published on 18 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS was configured with overly permissive security entitlements that could bypass macOS Hardened Runtime protections. This configuration allows attackers to inject malicious dynamic libraries into the application process, gaining access to all TCC (Transparency, Consent, and Control) permissions granted to the application. The fix is included starting from the `2.3.7 ` release.
Weakness: CWE-276
Which versions are affected by CVE-2025-64723?
It affects 1 product.
Products include Arduino Arduino Ide.
How do I fix CVE-2025-64723?
No fix has been published for CVE-2025-64723 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-64723 being exploited?
There is no known exploitation of CVE-2025-64723 in the wild and no public exploit code.
Other vulnerabilities in arduino-ide
Sources
Also known as GHSA-vf5j-xhwq-8vqj.