EUVD-2026-43669
GHSA-pf76-r749-m2hh
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local file-parsing RCE requiring the user to open a malicious file (AV:L/UI:R); no prior privileges are needed to open a document (PR:N, differing from vendor PR:L), with full CIA impact and no scope change.
Primary rating from Vendor (rockwellautomation).
CVSS VectorVendor: rockwellautomation
Lifecycle Timeline
2DescriptionCVE.org
A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the expmt.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.
AnalysisAI
Arbitrary code execution in Rockwell Automation Arena Simulation is possible through an out-of-bounds write in the expmt.exe (Siman) component, which fails to validate user-supplied data when parsing model/experiment files. A local attacker who convinces an engineer to open a malicious Arena file can run code in the context of the current user. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; it was self-reported by Rockwell's PSIRT (advisory SD1784).
Technical ContextAI
Arena is Rockwell Automation's discrete-event simulation product used in industrial and manufacturing process modeling; expmt.exe is the SIMAN experiment/model processor at its core. The root cause is CWE-787 (Out-of-Bounds Write): expmt.exe reads attacker-controlled fields from a crafted simulation file and writes past the bounds of an allocated buffer, corrupting adjacent memory. Such memory corruption in a native (C/C++) file parser is the classic precursor to control-flow hijack, which is why the vendor tags it Buffer Overflow, Memory Corruption, and RCE. No CPE strings were provided in the input, so exact affected build identifiers must be taken from the vendor advisory rather than NVD product enumeration.
RemediationAI
Consult Rockwell Automation advisory SD1784 (https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1784.html) and upgrade Arena Simulation to the fixed release identified there; the input data does not contain an exact fixed version number, so use the version specified in the advisory rather than any assumed value. Because exploitation requires opening a malicious file, the most effective compensating control until patched is operational: do not open Arena model/experiment files received from untrusted or external sources, and validate the origin of any shared .doe/model files (trade-off: slows collaboration and file sharing). Additionally, restrict and monitor Arena to hardened engineering workstations, apply least-privilege so a compromise of the user context yields minimal lateral value, and consider application allowlisting or blocking Arena file associations from email/web download paths (trade-off: may block legitimate double-click workflows).
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that
OpenForis Arena before 2019-05-07 allows SQL injection in the sorting feature. Rated critical severity (CVSS 9.8), this
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflo
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read o
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflo
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read o
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read o
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today