Vulnerability Intelligence Report
Rockwell Automation Arena® Simulation Stack-Based Buffer Overflow Vulnerability
CVE-2025-11918
Rockwell Automation Arena® suffers from a stack-based buffer overflow vulnerability. The specific flaw exists within the parsing of DOE files. Local attackers are able to exploit this issue to potentially execute arbitrary code on affected installations of Arena®. Exploiting the vulnerability requires opening a malicious DOE file.
No Active Exploit Signals
CVSS Base Score
7.1
HIGH
EPSS Probability:0.13%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-121 ↗CWE-121: Stack-based Buffer Overflow
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Rockwell Automation | Arena® Simulation | Version 16.20.10 and prior (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.133%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Rockwell Automation · Vendor · USA |
| Reserved | 2025-10-17T14:31:53 |
| Published | 2025-11-14T13:28:39 |
| Last Updated | 2025-11-14T15:44:16 |
Community Chatter & Buzz