CVE-2025-64723CWE-276

Arduino IDE for macOS has TCC Bypass via Dynamic Library Injection

Medium · published December 18, 2025

CVSS v4.0
4.8
EPSS
0%
Percentile
2.1
In the wild
Unconfirmed
What it is

Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS was configured with overly permissive security entitlements that could bypass macOS Hardened Runtime protections. This configuration allows attackers to inject malicious dynamic libraries into the application process, gaining access to all TCC (Transparency, Consent, and Control) permissions granted to the application. The fix is included starting from the `2.3.7 ` release.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00125 · 2.1th percentile
Weakness
CWE-276 · Incorrect Default Permissions
Published
2025-12-18T15:15Z
EPSS history
Timeline
  • 18 DEC 15:15Z
    Arduino IDE for macOS has TCC Bypass via Dynamic Library Injection
    cvelistv5