CVE-2025-69209

ArduinoCore-avr contains the source code and configuration files of the Arduino AVR Boards platform. A vulnerability in versions prior to 1.8.7 allows an attacker to trigger a stack-based buffer overflow when converting floating-point values to strings with high precision. By passing very large `decimalPlaces` values to the affected String constructors or concat methods, the `dtostrf` function writes beyond fixed-size stack buffers, causing memory corruption and denial of service. Under specific conditions, this could enable arbitrary code execution on AVR-based Arduino boards. ### Patches - The Fix is included starting from the `1.8.7` release available from the following link [ArduinoCore-avr v1.8.7](https://github.com/arduino/ArduinoCore-avr) - The Fixing Commit is available at the following link [1a6a417f89c8901dad646efce74ae9d3ddebfd59](https://github.com/arduino/ArduinoCore-avr/pull/613/commits/1a6a417f89c8901dad646efce74ae9d3ddebfd59) ### References - [ASEC-26-001 ArduinoCore-avr vXXXX Resolves Buffer Overflow Vulnerability](https://support.arduino.cc/hc/en-us/articles/XXXXX) ### Credits - Maxime Rossi Bellom and Ramtine Tofighi Shirazi from SecMate (https://secmate.dev/)

• CWE-120

• https://github.com/arduino/ArduinoCore-avr/commit/82a8ad2fb33911d8927c7af22e0472b94325d1a7
• https://github.com/arduino/ArduinoCore-avr/pull/613
• https://github.com/arduino/ArduinoCore-avr/releases/tag/1.8.7
• https://github.com/arduino/ArduinoCore-avr/security/advisories/GHSA-pvx3-fm7w-6hjm
• https://support.arduino.cc/hc/en-us/articles/24985906702748-ASEC-26-001-ArduinoCore-AVR-v1-8-7-Resolves-Stack-Based-Buffer-Overflow-Vulnerability

Published

Jan 21, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-69203Signal K Server is a server application that runs on a centr…8.8
• CVE-2025-69204ImageMagick is free and open-source software used for editin…7.5
• CVE-2025-69205Micro Registration Utility (µURU) is a telephone self regist…6.3
• CVE-2025-69206Hemmelig is a messing app with with client-side encryption a…4.3
• CVE-2025-69207Khoj is a self-hostable artificial intelligence app. Prior t…7.1
• CVE-2025-69208free5GC UDR is the user data repository (UDR) for free5GC, a…5.3
• CVE-2025-6921The huggingface/transformers library, versions prior to 4.53…7.5
• CVE-2025-69210FacturaScripts is open-source enterprise resource planning a…5.4
• CVE-2025-69211Nest is a framework for building scalable Node.js server-sid…7.4
• CVE-2025-69212OpenSTAManager is an open source management software for tec…8.8
• CVE-2025-69213OpenSTAManager is an open source management software for tec…8.8
• CVE-2025-69214OpenSTAManager is an open source management software for tec…8.8