EUVD-2026-43672
GHSA-h5wm-63j8-q5vc
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local file-open RCE: AV:L and UI:R because the victim must open a malicious file; PR:N since no attacker privileges are needed; full C/I/A impact as code runs as the user.
Primary rating from Vendor (rockwellautomation).
CVSS VectorVendor: rockwellautomation
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the linker.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.
AnalysisAI
Arbitrary code execution in Rockwell Automation Arena Simulation is possible through an out-of-bounds write in the linker.exe (Siman) component, which fails to properly validate user-supplied data parsed from simulation model files. A local attacker who convinces a user to open a specially crafted Arena file can corrupt memory and run code in the context of the current user. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to open an attacker-supplied malicious Arena/SIMAN model file in Arena Simulation on the local machine - the crafted file is processed by the linker.exe (Siman) component, whose improper validation of the file's user-supplied data triggers the out-of-bounds write. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H) scores 7.0 (High) and paints this as a local, user-interaction-dependent RCE rather than a remotely reachable service flaw - meaning it is a client-side 'malicious document' style bug, not a wormable network vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious Arena simulation model file with data engineered to trigger the out-of-bounds write in linker.exe and delivers it to a target engineer via email, a shared drive, or a project handoff. When the engineer opens the file in Arena Simulation, the memory corruption is triggered and the attacker's shellcode runs with that user's privileges. … |
| Remediation | Consult Rockwell Automation Security Advisory SD1784 (https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1784.html) and upgrade Arena Simulation to the fixed release identified there - a patch is available per the vendor advisory, though the input does not specify the exact patched version number, so obtain it directly from SD1784. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Arena installations across the organization and issue a security alert restricting users from opening Arena files from untrusted sources; prioritize systems with access to critical design data or industrial control systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that
OpenForis Arena before 2019-05-07 allows SQL injection in the sorting feature. Rated critical severity (CVSS 9.8), this
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflo
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read o
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflo
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read o
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read o
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today