EUVD-2026-43668
GHSA-269w-m449-w5rg
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
File-open RCE needs no attacker privileges (PR:N) but requires the victim to open a crafted file (UI:R) locally (AV:L); full code execution yields C/I/A:H, differing from vendor's PR:L.
Primary rating from Vendor (rockwellautomation).
CVSS VectorVendor: rockwellautomation
Lifecycle Timeline
2DescriptionCVE.org
A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the model.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.
AnalysisAI
Arbitrary code execution in Rockwell Automation Arena Simulation is possible through an out-of-bounds write in the model.exe (Siman) component when a victim opens a maliciously crafted simulation model file. The flaw lets an attacker run code in the context of the current user by tricking an operator or engineer into opening a booby-trapped file, making it a client-side, file-delivery RCE rather than a remotely reachable network service bug. No public exploit has been identified at time of analysis, and no EPSS or CISA KEV data was provided, so real-world exploitation appears limited to social-engineering-driven targeting.
Technical ContextAI
Arena Simulation is Rockwell Automation's discrete-event simulation product used to model manufacturing, logistics, and process workflows; the affected model.exe is its underlying Siman simulation engine that parses model/experiment files. The root cause is CWE-787 (Out-of-bounds Write): the Siman parser fails to properly validate the size or bounds of user-supplied fields in a model file before writing them into memory, corrupting adjacent memory structures. Such memory corruption in a native Windows desktop parser can typically be steered from a simple crash toward control of the instruction pointer, which is why the vendor tags this as Buffer Overflow / Memory Corruption / RCE. No specific affected-version list or CPE string was supplied in the intelligence beyond the product identification.
RemediationAI
Apply the update described in Rockwell Automation Security Advisory SD1784 (https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1784.html); a patch is available per the vendor advisory, but no exact fixed version number was included in the provided data, so confirm and install the specific patched build listed by Rockwell. Because exploitation depends entirely on opening a malicious model file, the most effective compensating control until patching is to only open Arena model files from trusted, verified sources and to treat unsolicited or externally-sourced .doe/model files as suspicious - the trade-off is workflow friction for teams that routinely exchange models. Additional hardening includes running Arena under a least-privileged, non-administrative user account to limit the blast radius of code executed in the current process context, and using application allow-listing or endpoint controls to restrict where model.exe can be launched from; these controls reduce impact but do not prevent the initial code execution.
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that
OpenForis Arena before 2019-05-07 allows SQL injection in the sorting feature. Rated critical severity (CVSS 9.8), this
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflo
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read o
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflo
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read o
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read o
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today