← Vulnerability feed

Vulnerability record · CVE-2025-7025 · published 5 August 2025

CVE-2025-7025: Rockwellautomation arena heap-based buffer overflow vulnerability

Rockwellautomation · Arena

A memory abuse issue exists in the Rockwell Automation Arena® Simulation. A custom file can force Arena Simulation to read and write past the end of memory space. Successful use requires user action, such as opening a bad file or webpage. If used, a threat actor could execute code or disclose information.

8.4 CVSS 4.0 High EPSS 0.26% · top 83.7% CWE-122 · Heap-based buffer overflow
8.4CVSS 4.0 base score
0.26%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

A memory abuse issue exists in the Rockwell Automation Arena® Simulation. A custom file can force Arena Simulation to read and write past the end of memory space. Successful use requires user action, such as opening a bad file or webpage. If used, a threat actor could execute code or disclose information.

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1731.html Vendor Advisory

Track CVE-2025-7025 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-29460Rockwellautomation arena out-of-bounds read vulnerabilityAn arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that could potentially allow a ma…EPSS 0.85%9.8CVE-2023-29461Rockwellautomation arena out-of-bounds read vulnerabilityAn arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that could potentially allow a ma…EPSS 0.85%8.8CVE-2023-29462Rockwellautomation arena out-of-bounds write vulnerabilityAn arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that could potentially allow a ma…EPSS 0.90%8.5CVE-2025-3288Rockwellautomation arena out-of-bounds read vulnerabilityA local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memor…EPSS 0.30%8.5CVE-2025-3289Rockwellautomation arena out-of-bounds write vulnerabilityA local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflow. The flaw is result of impr…EPSS 0.31%8.5CVE-2025-3286Rockwellautomation arena out-of-bounds read vulnerabilityA local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memor…EPSS 0.30%8.5CVE-2025-3287Rockwellautomation arena out-of-bounds read vulnerabilityA local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflow. The flaw is result of impr…EPSS 0.31%8.5CVE-2025-3285Rockwellautomation arena out-of-bounds read vulnerabilityA local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memor…EPSS 0.30%

Source: NIST National Vulnerability Database (record CVE-2025-7025), CISA KEV, FIRST EPSS (scores of 2026-10-13). This page is refreshed as NVD updates the record.