CVE-2025-11918: Rockwellautomation Arena

High severity, CVSS 7.3. EPSS: 0.2% chance of exploitation in the next 30 days.

Rockwell Automation Arena® suffers from a stack-based buffer overflow vulnerability. The specific flaw exists within the parsing of DOE files. Local attackers are able to exploit this issue to potentially execute arbitrary code on affected installations of Arena®. Exploiting the vulnerability requires opening a malicious DOE file.

Affected products

• Rockwellautomation Arena: before 16.20.11 (fixed in 16.20.11)

Published 2025-11-14. Last modified 2026-10-07.