{"id":"CVE-2025-69209","state":"PUBLISHED","title":"ArduinoCore-avr has Stack-Based Buffer Overflow in WString Float/Double Constructors","description":"ArduinoCore-avr contains the source code and configuration files of the Arduino AVR Boards platform. A vulnerability in versions prior to 1.8.7 allows an attacker to trigger a stack-based buffer overflow when converting floating-point values to strings with high precision. By passing very large `decimalPlaces` values to the affected String constructors or concat methods, the `dtostrf` function writes beyond fixed-size stack buffers, causing memory corruption and denial of service. Under specific conditions, this could enable arbitrary code execution on AVR-based Arduino boards.\n\n### Patches\n\n- The Fix is included starting from the `1.8.7` release available from the following link [ArduinoCore-avr v1.8.7](https://github.com/arduino/ArduinoCore-avr)\n\n- The Fixing Commit is available at the following link [1a6a417f89c8901dad646efce74ae9d3ddebfd59](https://github.com/arduino/ArduinoCore-avr/pull/613/commits/1a6a417f89c8901dad646efce74ae9d3ddebfd59)\n\n### References\n\n- [ASEC-26-001 ArduinoCore-avr vXXXX Resolves Buffer Overflow Vulnerability](https://support.arduino.cc/hc/en-us/articles/XXXXX)\n\n### Credits\n\n- Maxime Rossi Bellom and Ramtine Tofighi Shirazi from SecMate (https://secmate.dev/)","publishedAt":"2026-01-21T20:00:41.026Z","updatedAt":"2026-01-21T21:28:52.505Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["arduino ArduinoCore-avr"],"affected":[{"vendor":"arduino","product":"ArduinoCore-avr","versions":[{"version":"< 1.8.7","status":"affected"}]}],"references":["https://github.com/arduino/ArduinoCore-avr/security/advisories/GHSA-pvx3-fm7w-6hjm","https://github.com/arduino/ArduinoCore-avr/pull/613","https://github.com/arduino/ArduinoCore-avr/commit/82a8ad2fb33911d8927c7af22e0472b94325d1a7","https://github.com/arduino/ArduinoCore-avr/releases/tag/1.8.7","https://support.arduino.cc/hc/en-us/articles/24985906702748-ASEC-26-001-ArduinoCore-AVR-v1-8-7-Resolves-Stack-Based-Buffer-Overflow-Vulnerability"],"weaknesses":["CWE-120"],"ingestedAt":"2026-10-29T20:09:56.034Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/69xxx/CVE-2025-69209.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-69209","state":"PUBLISHED","datePublished":"2026-01-21T20:00:41.026Z","dateUpdated":"2026-01-21T21:28:52.505Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2025-12-29T14:58:36.634Z"},"containers":{"cna":{"title":"ArduinoCore-avr has Stack-Based Buffer Overflow in WString Float/Double Constructors","descriptions":[{"lang":"en","value":"ArduinoCore-avr contains the source code and configuration files of the Arduino AVR Boards platform. A vulnerability in versions prior to 1.8.7 allows an attacker to trigger a stack-based buffer overflow when converting floating-point values to strings with high precision. By passing very large `decimalPlaces` values to the affected String constructors or concat methods, the `dtostrf` function writes beyond fixed-size stack buffers, causing memory corruption and denial of service. Under specific conditions, this could enable arbitrary code execution on AVR-based Arduino boards.\n\n### Patches\n\n- The Fix is included starting from the `1.8.7` release available from the following link [ArduinoCore-avr v1.8.7](https://github.com/arduino/ArduinoCore-avr)\n\n- The Fixing Commit is available at the following link [1a6a417f89c8901dad646efce74ae9d3ddebfd59](https://github.com/arduino/ArduinoCore-avr/pull/613/commits/1a6a417f89c8901dad646efce74ae9d3ddebfd59)\n\n### References\n\n- [ASEC-26-001 ArduinoCore-avr vXXXX Resolves Buffer Overflow Vulnerability](https://support.arduino.cc/hc/en-us/articles/XXXXX)\n\n### Credits\n\n- Maxime Rossi Bellom and Ramtine Tofighi Shirazi from SecMate (https://secmate.dev/)"}],"affected":[{"vendor":"arduino","product":"ArduinoCore-avr","versions":[{"version":"< 1.8.7","status":"affected"}]}],"references":[{"url":"https://github.com/arduino/ArduinoCore-avr/security/advisories/GHSA-pvx3-fm7w-6hjm","name":"https://github.com/arduino/ArduinoCore-avr/security/advisories/GHSA-pvx3-fm7w-6hjm","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/arduino/ArduinoCore-avr/pull/613","name":"https://github.com/arduino/ArduinoCore-avr/pull/613","tags":["x_refsource_MISC"]},{"url":"https://github.com/arduino/ArduinoCore-avr/commit/82a8ad2fb33911d8927c7af22e0472b94325d1a7","name":"https://github.com/arduino/ArduinoCore-avr/commit/82a8ad2fb33911d8927c7af22e0472b94325d1a7","tags":["x_refsource_MISC"]},{"url":"https://github.com/arduino/ArduinoCore-avr/releases/tag/1.8.7","name":"https://github.com/arduino/ArduinoCore-avr/releases/tag/1.8.7","tags":["x_refsource_MISC"]},{"url":"https://support.arduino.cc/hc/en-us/articles/24985906702748-ASEC-26-001-ArduinoCore-AVR-v1-8-7-Resolves-Stack-Based-Buffer-Overflow-Vulnerability","name":"https://support.arduino.cc/hc/en-us/articles/24985906702748-ASEC-26-001-ArduinoCore-AVR-v1-8-7-Resolves-Stack-Based-Buffer-Overflow-Vulnerability","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV4_0":{"attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":6.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-120","lang":"en","description":"CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-01-21T20:00:41.026Z"},"source":{"advisory":"GHSA-pvx3-fm7w-6hjm","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-01-21T21:28:44.959537Z","id":"CVE-2025-69209","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-21T21:28:52.505Z"}}]}}}