EUVD-2026-43672
GHSA-h5wm-63j8-q5vc
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local file-open RCE: AV:L and UI:R because the victim must open a malicious file; PR:N since no attacker privileges are needed; full C/I/A impact as code runs as the user.
Primary rating from Vendor (rockwellautomation).
CVSS VectorVendor: rockwellautomation
Lifecycle Timeline
2DescriptionCVE.org
A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the linker.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.
AnalysisAI
Arbitrary code execution in Rockwell Automation Arena Simulation is possible through an out-of-bounds write in the linker.exe (Siman) component, which fails to properly validate user-supplied data parsed from simulation model files. A local attacker who convinces a user to open a specially crafted Arena file can corrupt memory and run code in the context of the current user. No public exploit has been identified at time of analysis, the issue is not in CISA KEV, and no EPSS score was provided, so real-world exploitation appears theoretical rather than observed.
Technical ContextAI
Arena Simulation is Rockwell Automation's discrete-event modeling and simulation product used in industrial, manufacturing, and process-engineering environments; the flawed code lives in linker.exe, which is tied to the underlying SIMAN simulation language/engine that links and processes model definitions. The root cause is CWE-787 (Out-of-Bounds Write): during parsing of attacker-controlled file content the component computes a write location or length from unvalidated input, allowing data to be written past the bounds of the intended memory buffer. Because the corrupted write occurs in a native Windows desktop executable, controlled overwrites of adjacent memory (heap/stack structures, pointers) can be steered toward control-flow hijacking and code execution, consistent with the reporter's 'Buffer Overflow / Memory Corruption / RCE' tags.
RemediationAI
Consult Rockwell Automation Security Advisory SD1784 (https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1784.html) and upgrade Arena Simulation to the fixed release identified there - a patch is available per the vendor advisory, though the input does not specify the exact patched version number, so obtain it directly from SD1784. Until patched, apply file-handling hygiene as the primary compensating control: do not open Arena/SIMAN model files (e.g., .doe and related model artifacts) received from untrusted or unverified sources, and treat such files like any other executable content. Restrict Arena to trusted engineering workstations and use standard-user (non-administrator) accounts so that code executing 'in the context of the current user' has minimal privilege, limiting blast radius; the trade-off is reduced convenience for engineers who routinely exchange model files. Application allow-listing and blocking Arena from spawning child processes can further contain post-exploitation, at the cost of tuning to avoid breaking legitimate simulation workflows.
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that
OpenForis Arena before 2019-05-07 allows SQL injection in the sorting feature. Rated critical severity (CVSS 9.8), this
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflo
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read o
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflo
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read o
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read o
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today