VULNERABILITY INTELLIGENCE

CVE-2025-11918

CVSS score7.3 HIGH
EPSS probability0.17%
CISA KEVNot currently listed
Published2025-11-14
Last modified2026-10-07
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Description

Rockwell Automation Arena® suffers from a stack-based buffer overflow vulnerability. The specific flaw exists within the parsing of DOE files. Local attackers are able to exploit this issue to potentially execute arbitrary code on affected installations of Arena®. Exploiting the vulnerability requires opening a malicious DOE file.

Weakness classification

  • PSIRT@rockwellautomation.com: CWE-121

Primary references