CVE-2025-64724: Arduino IDE for macOS has Insecure File Permissions
Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS is installed with world-writable file permissions on sensitive application components, allowing any local user to replace legitimate files with malicious code. When another user launches the application, the malicious code executes with that user's privileges, enabling privilege escalation and unauthorized access to sensitive data. The fix is included starting from the 2.3.7 release.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64724?
CVE-2025-64724 is considered a high-severity vulnerability due to the potential for local users to execute malicious code.
How do I fix CVE-2025-64724?
To fix CVE-2025-64724, upgrade Arduino IDE to version 2.3.7 or later.
Who is affected by CVE-2025-64724?
CVE-2025-64724 affects users of Arduino IDE prior to version 2.3.7 on macOS.
What type of vulnerability is CVE-2025-64724?
CVE-2025-64724 is a file permission vulnerability that allows local users to modify sensitive application files.
Can CVE-2025-64724 impact system security?
Yes, CVE-2025-64724 can significantly impact system security by enabling unauthorized changes to application code.