CVE-2025-2829

Severity CVSS v4.0:
HIGH
Type:
CWE-787 Out-of-bounds Write
Publication date:
08/04/2025
Last modified:
14/07/2025

Description

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data.  If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:rockwellautomation:arena:*:*:*:*:*:*:*:* 16.20.09 (excluding)