CVE-2025-11918
Rockwell Automation Arena® suffers from a stack-based buffer overflow vulnerability. The specific flaw exists within the parsing of DOE files. Local attackers are able to exploit this issue to potentially execute arbitrary code on affected installations of Arena®. Exploiting the vulnerability requires opening a malicious DOE file.
- CVSS 4.0
- 7.1
CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.3
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 5% of CVEs (scores of 2026-10-25)
- CWE
- CWE-121
- Published
- Modified
- Record from
- the NVD, synced
Affected
- rockwellautomation:arena