CVE-2025-11918: rockwell automation arena simulation Stack-based Buffer Overflow

Vulnerability summary

CVE-2025-11918 is a high (CVSS 7.3) Stack-based Buffer Overflow vulnerability in rockwell automation arena simulation. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 5.7% of scored vulnerabilities.

Timeline

1. 14-11-2025
   PublishedVulnerability first disclosed.
2. 14-11-2025
   Last modifiedVulnerability information updated.

Description

Rockwell Automation Arena® suffers from a stack-based buffer overflow vulnerability. The specific flaw exists within the parsing of DOE files. Local attackers are able to exploit this issue to potentially execute arbitrary code on affected installations of Arena®. Exploiting the vulnerability requires opening a malicious DOE file.

• CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).