EUVD-2026-43669
GHSA-pf76-r749-m2hh
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local file-parsing RCE requiring the user to open a malicious file (AV:L/UI:R); no prior privileges are needed to open a document (PR:N, differing from vendor PR:L), with full CIA impact and no scope change.
Primary rating from Vendor (rockwellautomation).
CVSS VectorVendor: rockwellautomation
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the expmt.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.
AnalysisAI
Arbitrary code execution in Rockwell Automation Arena Simulation is possible through an out-of-bounds write in the expmt.exe (Siman) component, which fails to validate user-supplied data when parsing model/experiment files. A local attacker who convinces an engineer to open a malicious Arena file can run code in the context of the current user. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a victim to open an attacker-supplied malicious Arena Simulation file in the expmt.exe (SIMAN) component - the file-open action is the mandatory trigger (UI:P/UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score is 7.0 (High) with vector AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H - a local vector requiring user interaction (opening a file), yielding full confidentiality/integrity/availability impact on the vulnerable system with no scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious Arena simulation/experiment file with malformed fields that trigger the out-of-bounds write in expmt.exe, then delivers it to a simulation engineer via email or a shared project repository. When the victim opens the file in Arena, memory corruption is triggered and the attacker's shellcode executes with the victim's privileges, giving a foothold on the engineering workstation. … |
| Remediation | Consult Rockwell Automation advisory SD1784 (https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1784.html) and upgrade Arena Simulation to the fixed release identified there; the input data does not contain an exact fixed version number, so use the version specified in the advisory rather than any assumed value. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, issue security guidance to engineering staff warning against opening Arena model or experiment files from untrusted external sources, and disable automatic file preview features in Arena if available. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that
OpenForis Arena before 2019-05-07 allows SQL injection in the sorting feature. Rated critical severity (CVSS 9.8), this
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflo
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read o
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflo
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read o
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read o
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today