CVE-2025-64724 Arduino IDE for macOS has Insecure File Permissions
Local attackers can replace world-writable Arduino IDE files with malicious code, leading to privilege escalation and code execution when other users launch the application.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-64724?
CVE-2025-64724 is a medium-severity vulnerability in arduino-ide, published on 18 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS is installed with world-writable file permissions on sensitive application components, allowing any local user to replace legitimate files with malicious code. When another user launches the application, the malicious code executes with that user's privileges, enabling privilege escalation and unauthorized access to sensitive data. The fix is included starting from the `2.3.7` release.
Weakness: CWE-276
Which versions are affected by CVE-2025-64724?
It affects 1 product.
Products include Arduino Arduino Ide.
How do I fix CVE-2025-64724?
No fix has been published for CVE-2025-64724 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-64724 being exploited?
There is no known exploitation of CVE-2025-64724 in the wild and no public exploit code.
Other vulnerabilities in arduino-ide
Sources
Also known as GHSA-3fvj-pgqw-fgw6.