CVE-2025-69209

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-69209
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-69209.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-69209
Aliases
  • GHSA-pvx3-fm7w-6hjm
Downstream
Published
2026-01-21T20:00:41.026Z
Modified
2026-03-14T12:46:12.801397Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
ArduinoCore-avr has Stack-Based Buffer Overflow in WString Float/Double Constructors
Details

ArduinoCore-avr contains the source code and configuration files of the Arduino AVR Boards platform. A vulnerability in versions prior to 1.8.7 allows an attacker to trigger a stack-based buffer overflow when converting floating-point values to strings with high precision. By passing very large decimalPlaces values to the affected String constructors or concat methods, the dtostrf function writes beyond fixed-size stack buffers, causing memory corruption and denial of service. Under specific conditions, this could enable arbitrary code execution on AVR-based Arduino boards.

Patches

References

Credits

  • Maxime Rossi Bellom and Ramtine Tofighi Shirazi from SecMate (https://secmate.dev/)
Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69209.json",
    "cwe_ids": [
        "CWE-120"
    ]
}
References

Affected packages

Git / github.com/arduino/arduinocore-avr

Affected ranges

Type
GIT
Repo
https://github.com/arduino/arduinocore-avr
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
82a8ad2fb33911d8927c7af22e0472b94325d1a7
Type
GIT
Repo
https://github.com/arduino/arduinocore-avr
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d5d1355b95fd57bbcd30b86db5dc0003440eee8d

Affected versions

1.*
1.6.22
1.6.23
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-69209.json"