Stack-Based Buffer Overflow in Arduino AVR Boards by Arduino
CVE-2025-69209

6.9MEDIUM

Key Information:

Vendor

Arduino

Status
Arduinocore-avr
Vendor
CVE Published:
21 January 2026

What is CVE-2025-69209?

A buffer overflow vulnerability exists in ArduinoCore-avr for versions prior to 1.8.7. This flaw allows attackers to exploit the dtostrf function when improperly handling large decimalPlaces parameters. By invoking String constructors or concat methods with excessively large values, it can write beyond allocated stack buffers, leading to memory corruption and service disruption. In certain scenarios, this vulnerability could enable unauthorized code execution on AVR-based devices, posing serious security risks.

Affected Version(s)

ArduinoCore-avr < 1.8.7

References

https://github.com/arduino/ArduinoCore-avr/security/advis...
x_refsource_CONFIRM
https://github.com/arduino/ArduinoCore-avr/pull/613
x_refsource_MISC
https://github.com/arduino/ArduinoCore-avr/commit/82a8ad2...
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.