CVE-2026-8313

Rockwell Automation Arena® - Memory Corruption Vulnerability

A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the linker.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Rockwell Automation Rockwellautomation

Products

Arena Arena Arena Simulation

CVE-2026-8314

Rockwell Automation Arena® - Memory Corruption Vulnerability

A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the siman.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Rockwell Automation Rockwellautomation

Products

Arena Arena Arena Simulation

CVE-2026-6071

Code Execution Vulnerability in Arena®

A remote code execution security issue exists in the affected products when parsing DOE files that could allow a remote attacker to write past the end of an allocated object and execute code within the context of the current process. To exploit this vulnerability, a legitimate user must visit a malicious page or open a malicious file.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Rockwell Automation Rockwellautomation

Products

Arena Arena

CVE-2026-8085

Rockwell Automation Arena® - Memory Corruption Vulnerability

A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the model.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Rockwellautomation

Products

Arena

CVE-2026-8312

Rockwell Automation Arena® - Memory Corruption Vulnerability

A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the expmt.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Rockwellautomation

Products

Arena

CVE-2025-7025

Rockwell Automation Heap-based Buffer Overflow In Arena® Simulation

A memory abuse issue exists in the Rockwell Automation Arena® Simulation. A custom file can force Arena Simulation to read and write past the end of memory space. Successful use requires user action, such as opening a bad file or webpage. If used, a threat actor could execute code or disclose information.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Rockwellautomation

Products

Arena

CVE-2025-7032

Rockwell Automation Stack-based Buffer Overflow In Arena® Simulation

A memory abuse issue exists in the Rockwell Automation Arena® Simulation. A custom file can force Arena Simulation to read and write past the end of memory space. Successful use requires user action, such as opening a bad file or webpage. If used, a threat actor could execute code or disclose information.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Rockwellautomation

Products

Arena

CVE-2025-7033

Rockwell Automation Heap-based Buffer Overflow In Arena® Simulation

A memory abuse issue exists in the Rockwell Automation Arena® Simulation. A custom file can force Arena Simulation to read and write past the end of memory space. Successful use requires user action, such as opening a bad file or webpage. If used, a threat actor could execute code or disclose information.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Rockwellautomation

Products

Arena Arena Simulation

CVE-2025-11918

Rockwell Automation Arena® Simulation Stack-Based Buffer Overflow Vulnerability

Rockwell Automation Arena® suffers from a stack-based buffer overflow vulnerability. The specific flaw exists within the parsing of DOE files. Local attackers are able to exploit this issue to potentially execute arbitrary code on affected installations of Arena®. Exploiting the vulnerability requires opening a malicious DOE file.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Rockwellautomation

Products

Arena Arena Simulation

CVE-2025-2285

Local Code Execution Vulnerability in Arena®

A local code execution vulnerability exists in the Rockwell Automation Arena®  due to an uninitialized pointer. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Rockwellautomation

Products

Arena

CVE-2025-2287

Local Code Execution Vulnerability in Arena®

A local code execution vulnerability exists in the Rockwell Automation Arena®  due to an uninitialized pointer. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Rockwellautomation

Products

Arena

CVE-2025-2288

Local Code Execution Vulnerability in Arena®

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data.  If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Rockwellautomation

Products

Arena

CVE-2025-2286

Local Code Execution Vulnerability in Arena®

A local code execution vulnerability exists in the Rockwell Automation Arena®  due to an uninitialized pointer. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Rockwellautomation

Products

Arena

CVE-2025-2293

Local Code Execution Vulnerability in Arena®

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data.  If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Rockwellautomation

Products

Arena

CVE-2025-2829

Local Code Execution Vulnerability in Arena®

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data.  If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Rockwellautomation

Products

Arena

CVE-2025-3286

Local Code Execution Vulnerability in Arena®

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data.  If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Rockwellautomation

Products

Arena

CVE-2025-3285

Local Code Execution Vulnerability in Arena®

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data.  If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Rockwellautomation

Products

Arena

CVE-2025-3287

Local Code Execution Vulnerability in Arena®

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflow. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Rockwellautomation

Products

Arena

CVE-2025-3288

Local Code Execution Vulnerability in Arena®

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data.  If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Rockwellautomation

Products

Arena

CVE-2025-3289

Local Code Execution Vulnerability in Arena®

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflow. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Rockwellautomation

Products

Arena