Rockwellautomation Arena

Arena DOE File Parsing Stack Buffer Overflow (CVE-2025-11918)
CVE-2025-11918 - November 14, 2025

Rockwell Automation Arena® suffers from a stack-based buffer overflow vulnerability. The specific flaw exists within the parsing of DOE files. Local attackers are able to exploit this issue to potentially execute arbitrary code on affected installations of Arena®. Exploiting the vulnerability requires opening a malicious DOE file.

Stack Overflow

Arena Simulation RCE via Memory Overwrite with Bad File
CVE-2025-7025 7.8 - High - August 05, 2025

A memory abuse issue exists in the Rockwell Automation Arena® Simulation. A custom file can force Arena Simulation to read and write past the end of memory space. Successful use requires user action, such as opening a bad file or webpage. If used, a threat actor could execute code or disclose information.

Arena Simulation FUA/IO Buffer Overflow | RCE via Custom File
CVE-2025-7032 7.8 - High - August 05, 2025

A memory abuse issue exists in the Rockwell Automation Arena® Simulation. A custom file can force Arena Simulation to read and write past the end of memory space. Successful use requires user action, such as opening a bad file or webpage. If used, a threat actor could execute code or disclose information.

Memory Abuse RCE in Rockwell Arena Simulation via Malicious File
CVE-2025-7033 7.8 - High - August 05, 2025

A memory abuse issue exists in the Rockwell Automation Arena® Simulation. A custom file can force Arena Simulation to read and write past the end of memory space. Successful use requires user action, such as opening a bad file or webpage. If used, a threat actor could execute code or disclose information.

Rockwell Arena Simulation: RCE via crafted DOE file
CVE-2025-6377 7.8 - High - July 09, 2025

A remote code execution security issue exists in the Rockwell Automation Arena®.  A crafted DOE file can force Arena Simulation to write beyond the boundaries of an allocated object. Exploitation requires user interaction, such as opening a malicious file within the software. If exploited, a threat actor could execute arbitrary code on the target system. The software must run under the context of the administrator in order to cause worse case impact. This is reflected in the Rockwell CVSS score, as AT:P.

Memory Corruption

RCE via Malformed DOE File in Rockwell Automation Arena
CVE-2025-6376 7.8 - High - July 09, 2025

A remote code execution security issue exists in the Rockwell Automation Arena®.  A crafted DOE file can force Arena Simulation to write beyond the boundaries of an allocated object. Exploitation requires user interaction, such as opening a malicious file within the software. If exploited, a threat actor could execute arbitrary code on the target system. The software must run under the context of the administrator in order to cause worse case impact. This is reflected in the Rockwell CVSS score, as AT:P.

Memory Corruption

LCE via Buffer Overflow in Rockwell Automation Arena from Malicious DOE File
CVE-2025-2829 7.8 - High - April 08, 2025

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data.  If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.

CVE-2025-3289: LCE via Stack Buffer Overflow in Rockwell Arena
CVE-2025-3289 7.8 - High - April 08, 2025

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflow. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.

Memory Corruption

Rockwell Arena LCE: OOB Read via malicious DOE file
CVE-2025-3288 7.8 - High - April 08, 2025

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data.  If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.

Rockwell Automation Arena LCE via Stack Buffer Overflow
CVE-2025-3287 7.8 - High - April 08, 2025

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflow. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.

LCE via Buffer Overflow in Rockwell Automation Arena (DOE file)
CVE-2025-3286 7.8 - High - April 08, 2025

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data.  If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.

Rockwell Arena LCE via DOE file memory buffer overread
CVE-2025-3285 7.8 - High - April 08, 2025

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data.  If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.

Local Code Execution (LCE) in Rockwell Automation Arena via OOB Write
CVE-2025-2293 7.8 - High - April 08, 2025

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data.  If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.

Rockwell Arena LCE via DOE file buffer overflow
CVE-2025-2288 7.8 - High - April 08, 2025

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data.  If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.

LCE in Rockwell Automation Arena via uninitialized pointer in DOE file
CVE-2025-2287 7.8 - High - April 08, 2025

A local code execution vulnerability exists in the Rockwell Automation Arena®  due to an uninitialized pointer. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.

Access of Uninitialized Pointer

Rockwell Automation Arena LCE via Uninitialized Pointer in DOE File
CVE-2025-2286 7.8 - High - April 08, 2025

A local code execution vulnerability exists in the Rockwell Automation Arena®  due to an uninitialized pointer. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.

Access of Uninitialized Pointer

LCX in Rockwell Automation Arena due to uninitialized pointer
CVE-2025-2285 7.8 - High - April 08, 2025

A local code execution vulnerability exists in the Rockwell Automation Arena®  due to an uninitialized pointer. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.

Access of Uninitialized Pointer

Rockwell Automation Arena Uninitialized Variable Code Execution Vulnerability
CVE-2024-11364 7.3 - High - December 19, 2024

Another uninitialized variable code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and force the software to access a variable prior to it being initialized. If exploited, a threat actor could leverage this vulnerability to execute arbitrary code. To exploit this vulnerability, a legitimate user must execute the malicious code crafted by the threat actor.

Use of Uninitialized Resource

Rockwell Automation Arena® Out-of-Bounds Write Vulnerability in DOE File Handling
CVE-2024-11157 7.3 - High - December 19, 2024

A third-party vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to write beyond the boundaries of allocated memory in a DOE file. If exploited, a threat actor could leverage this vulnerability to execute arbitrary code. To exploit this vulnerability, a legitimate user must execute the malicious code crafted by the threat actor.

Memory Corruption

Rockwell Automation Arena Use-After-Free Code Execution Vulnerability in DOE File Handling
CVE-2024-12175 7.8 - High - December 19, 2024

Another use after free code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and force the software to use a resource that was already used. If exploited, a threat actor could leverage this vulnerability to execute arbitrary code. To exploit this vulnerability, a legitimate user must execute the malicious code crafted by the threat actor.

Dangling pointer

Rockwell Automation Arena® Out-of-Bounds Write Vulnerability in DOE File Handling
CVE-2024-12672 7.3 - High - December 19, 2024

A third-party vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to write beyond the boundaries of allocated memory in a DOE file. If exploited, a threat actor could leverage this vulnerability to execute arbitrary code. To exploit this vulnerability, a legitimate user must execute the malicious code crafted by the threat actor.

Rockwell Automation Arena Out-of-Bounds Read Code Execution Vulnerability
CVE-2024-12130 7.8 - High - December 05, 2024

An out of bounds read code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and force the software to read beyond the boundaries of an allocated memory. If exploited, a threat actor could leverage this vulnerability to execute arbitrary code. To exploit this vulnerability, a legitimate user must execute the malicious code crafted by the threat actor.

Out-of-bounds Read

Rockwell Automation Arena® Out-of-Bounds Write Code Execution Vulnerability in DOE File Handling
CVE-2024-11156 7.8 - High - December 05, 2024

An out of bounds write code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to write beyond the boundaries of allocated memory in a DOE file. If exploited, a threat actor could leverage this vulnerability to execute arbitrary code. To exploit this vulnerability, a legitimate user must execute the malicious code crafted by the threat actor.

Memory Corruption

Rockwell Automation Arena Use After Free Code Execution Vulnerability
CVE-2024-11155 - December 05, 2024

A use after free code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and force the software to use a resource that was already used. If exploited, a threat actor could leverage this vulnerability to execute arbitrary code. To exploit this vulnerability, a legitimate user must execute the malicious code crafted by the threat actor.

Dangling pointer

Rockwell Automation Arena® Uninitialized Variable Code Execution Vulnerability
CVE-2024-11158 - December 05, 2024

An uninitialized variable code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and force the software to access a variable before it being initialized. If exploited, a threat actor could leverage this vulnerability to execute arbitrary code. To exploit this vulnerability, a legitimate user must execute the malicious code crafted by the threat actor.

Improper Initialization

Memory Corruption in Rockwell Automation Arena Simulation Allows ACE
CVE-2024-2929 7.8 - High - March 26, 2024

A memory corruption vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code to the software by corrupting the memory triggering an access violation. Once inside, the threat actor can run harmful code on the system. This affects the confidentiality, integrity, and availability of the product. To trigger this, the user would unwittingly need to open a malicious file shared by the threat actor.

Memory Corruption

CVE-2024-21920: Memory Buffer Over-read in Rockwell Automation Arena Simulation
CVE-2024-21920 7.1 - High - March 26, 2024

A memory buffer vulnerability in Rockwell Automation Arena Simulation could potentially let a threat actor read beyond the intended memory boundaries. This could reveal sensitive information and even cause the application to crash, resulting in a denial-of-service condition. To trigger this, the user would unwittingly need to open a malicious file shared by the threat actor.

Out-of-bounds Read

CVE-2024-21919: Uninitialized Pointer in Rockwell Arena Sim Enables Code Exec
CVE-2024-21919 7.8 - High - March 26, 2024

An uninitialized pointer in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code to the software by leveraging the pointer after it is properly. Once inside, the threat actor can run harmful code on the system. This affects the confidentiality, integrity, and availability of the product. To trigger this, the user would unwittingly need to open a malicious file shared by the threat actor.

Access of Uninitialized Pointer

Arena Sim Memory Buffer Overflow Enables Remote Code Execution
CVE-2024-21918 7.8 - High - March 26, 2024

A memory buffer vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code to the software by corrupting the memory and triggering an access violation. Once inside, the threat actor can run harmful code on the system. This affects the confidentiality, integrity, and availability of the product. To trigger this, the user would unwittingly need to open a malicious file shared by the threat actor.

Dangling pointer

CVE-2024-21913: Heap Buffer Overflow in Rockwell Automation Arena Simulation
CVE-2024-21913 7.8 - High - March 26, 2024

A heap-based memory buffer overflow vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code into the software by overstepping the memory boundaries, which triggers an access violation. Once inside, the threat actor can run harmful code on the system. This affects the confidentiality, integrity, and availability of the product. To trigger this, the user would unwittingly need to open a malicious file shared by the threat actor.

Memory Corruption

Rockwell Automation Arena Simulation OOB Buffer ARBCE via Malicious File
CVE-2024-21912 7.8 - High - March 26, 2024

An arbitrary code execution vulnerability in Rockwell Automation Arena Simulation could let a malicious user insert unauthorized code into the software. This is done by writing beyond the designated memory area, which causes an access violation. Once inside, the threat actor can run harmful code on the system. This affects the confidentiality, integrity, and availability of the product. To trigger this, the user would unwittingly need to open a malicious file shared by the threat actor.

Memory Corruption

Arena Simulation Buffer Overflow Enables AUC
CVE-2023-27854 7.8 - High - October 27, 2023

An arbitrary code execution vulnerability was reported to Rockwell Automation in Arena Simulation that could potentially allow a malicious user to commit unauthorized arbitrary code to the software by using a memory buffer overflow.  The threat-actor could then execute malicious code on the system affecting the confidentiality, integrity, and availability of the product.  The user would need to open a malicious file provided to them by the attacker for the code to execute.

Out-of-bounds Read

Rockwell Automation Arena Simulation: Uninit Pointer Enables AUCEx
CVE-2023-27858 7.8 - High - October 27, 2023

Rockwell Automation Arena Simulation contains an arbitrary code execution vulnerability that could potentially allow a malicious user to commit unauthorized code to the software by using an uninitialized pointer in the application.  The threat-actor could then execute malicious code on the system affecting the confidentiality, integrity, and availability of the product.  The user would need to open a malicious file provided to them by the attacker for the code to execute.

Access of Uninitialized Pointer

Arena Sim: Heap Buffer Overflow Enables Arbitrary Code Exec
CVE-2023-29462 8.8 - High - May 09, 2023

An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that could potentially allow a malicious user to commit unauthorized arbitrary code to the software by using a memory buffer overflow in the heap. potentially resulting in a complete loss of confidentiality, integrity, and availability.

Memory Corruption

CVE-2023-29461: Arena Heap Overflow Allows Arbitrary Exec
CVE-2023-29461 9.8 - Critical - May 09, 2023

An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that could potentially allow a malicious user to commit unauthorized arbitrary code to the software by using a memory buffer overflow in the heap. potentially resulting in a complete loss of confidentiality, integrity, and availability.

Out-of-bounds Read

Arbitrary Code Execution via Buffer Overflow in Rockwell Automation Arena
CVE-2023-29460 9.8 - Critical - May 09, 2023

An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that could potentially allow a malicious user to commit unauthorized arbitrary code to the software by using a memory buffer overflow potentially resulting in a complete loss of confidentiality, integrity, and availability.

Out-of-bounds Read

A maliciously crafted program file opened by an unsuspecting user of Rockwell Automation Arena Simulation Software version 16.00.00 and earlier may result in the limited exposure of information related to the targeted workstation
CVE-2019-13521 - January 27, 2020

A maliciously crafted program file opened by an unsuspecting user of Rockwell Automation Arena Simulation Software version 16.00.00 and earlier may result in the limited exposure of information related to the targeted workstation. Rockwell Automation has released version 16.00.01 of Arena Simulation Software to address the reported vulnerabilities.

Insufficient UI Warning of Dangerous Operations

A maliciously crafted program file opened by an unsuspecting user of Rockwell Automation Arena Simulation Software version 16.00.00 and earlier may result in the limited exposure of information related to the targeted workstation
CVE-2019-13519 - January 27, 2020

A maliciously crafted program file opened by an unsuspecting user of Rockwell Automation Arena Simulation Software version 16.00.00 and earlier may result in the limited exposure of information related to the targeted workstation. Rockwell Automation has released version 16.00.01 of Arena Simulation Software to address the reported vulnerabilities.

Object Type Confusion

In Rockwell Automation Arena Simulation Software Cat
CVE-2019-13527 - September 24, 2019

In Rockwell Automation Arena Simulation Software Cat. 9502-Ax, Versions 16.00.00 and earlier, a maliciously crafted Arena file opened by an unsuspecting user may result in the use of a pointer that has not been initialized.

Access of Uninitialized Pointer

Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain an INFORMATION EXPOSURE CWE-200
CVE-2019-13511 - August 15, 2019

Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain an INFORMATION EXPOSURE CWE-200. A maliciously crafted Arena file opened by an unsuspecting user may result in the limited exposure of information related to the targeted workstation.

Information Disclosure

Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain a USE AFTER FREE CWE-416
CVE-2019-13510 - August 15, 2019

Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain a USE AFTER FREE CWE-416. A maliciously crafted Arena file opened by an unsuspecting user may result in the application crashing or the execution of arbitrary code.

Dangling pointer

Rockwell Automation Arena versions 15.10.00 and prior contains a use after free vulnerability caused by processing specially crafted Arena Simulation Software files
CVE-2018-8843 5.5 - Medium - May 14, 2018

Rockwell Automation Arena versions 15.10.00 and prior contains a use after free vulnerability caused by processing specially crafted Arena Simulation Software files that may cause the software application to crash, potentially losing any unsaved data..

Dangling pointer