Buffer Overflow Affecting arduino-core-avr package, versions <1.8.7+dfsg-1
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-DEBIAN14-ARDUINOCOREAVR-15062027
- published23 Jan 2026
- disclosed21 Jan 2026
Introduced: 21 Jan 2026
CVE-2025-69209 (opens in a new tab)How to fix?
Upgrade Debian:14 arduino-core-avr to version 1.8.7+dfsg-1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream arduino-core-avr package and not the arduino-core-avr package as distributed by Debian.
See How to fix? for Debian:14 relevant fixed versions and status.
ArduinoCore-avr contains the source code and configuration files of the Arduino AVR Boards platform. A vulnerability in versions prior to 1.8.7 allows an attacker to trigger a stack-based buffer overflow when converting floating-point values to strings with high precision. By passing very large decimalPlaces values to the affected String constructors or concat methods, the dtostrf function writes beyond fixed-size stack buffers, causing memory corruption and denial of service. Under specific conditions, this could enable arbitrary code execution on AVR-based Arduino boards.
Patches
The Fix is included starting from the
1.8.7release available from the following link ArduinoCore-avr v1.8.7The Fixing Commit is available at the following link 1a6a417f89c8901dad646efce74ae9d3ddebfd59
References
Credits
- Maxime Rossi Bellom and Ramtine Tofighi Shirazi from SecMate (https://secmate.dev/)
References
- https://security-tracker.debian.org/tracker/CVE-2025-69209
- https://github.com/arduino/ArduinoCore-avr/commit/82a8ad2fb33911d8927c7af22e0472b94325d1a7
- https://github.com/arduino/ArduinoCore-avr/pull/613
- https://github.com/arduino/ArduinoCore-avr/releases/tag/1.8.7
- https://github.com/arduino/ArduinoCore-avr/security/advisories/GHSA-pvx3-fm7w-6hjm
- https://support.arduino.cc/hc/en-us/articles/24985906702748-ASEC-26-001-ArduinoCore-AVR-v1-8-7-Resolves-Stack-Based-Buffer-Overflow-Vulnerability