CVE-2025-6376 Arena® Simulation Out-Of-Bounds Write Remote Code Execution Vulnerability
Attackers can execute arbitrary code by tricking users into opening a malicious DOE file in Rockwell Arena Simulation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-6376?
CVE-2025-6376 is a high-severity memory corruption vulnerability in Rockwell Automation Arena®, published on 9 Jul 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A remote code execution security issue exists in the Rockwell Automation Arena®. A crafted DOE file can force Arena Simulation to write beyond the boundaries of an allocated object. Exploitation requires user interaction, such as opening a malicious file within the software. If exploited, a threat actor could execute arbitrary code on the target system. The software must run under the context of the administrator in order to cause worse case impact. This is reflected in the Rockwell CVSS score, as AT:P.
Which versions are affected by CVE-2025-6376?
It affects 1 product.
Products include Rockwellautomation Arena.
How do I fix CVE-2025-6376?
No fix has been published for CVE-2025-6376 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-6376 being exploited?
There is no known exploitation of CVE-2025-6376 in the wild and no public exploit code.
Other vulnerabilities in Rockwell Automation Arena®
Sources
Also known as GHSA-m5mv-9gvp-xvx4.