CVE-2025-11918: 
NixOS vulnerability analysis and mitigation

CVE-2025-11918 is a stack-based buffer overflow vulnerability in Rockwell Automation Arena® Simulation software affecting versions 16.20.10 and prior (fixed in 16.20.11). The flaw exists within the parsing of DOE files, allowing local attackers to potentially execute arbitrary code when a victim opens a malicious DOE file. It was published on November 14, 2025, with a patch advisory released shortly after. The vulnerability carries a CVSS v3.1 base score of 7.3 (High) and a CVSS v4.0 base score of 7.1 (High) (Rockwell Advisory, CISA ICS Advisory).

The vulnerability is classified as CWE-121 (Stack-based Buffer Overflow), rooted in insufficient bounds checking during the parsing of DOE (Design of Experiments) files within Rockwell Automation Arena®. An attacker can craft a malicious DOE file that, when opened by a user, triggers a stack buffer overflow, potentially overwriting return addresses or control data to redirect execution flow. Exploitation requires local access and active user interaction — specifically, the victim must open the crafted file — making this a file-format parsing attack typical of simulation and engineering software (Rockwell Advisory, CISA ICS Advisory).

Successful exploitation of CVE-2025-11918 can result in arbitrary code execution on the affected workstation with the privileges of the user running Arena®. This leads to high confidentiality, integrity, and availability impacts on the local system, potentially enabling an attacker to steal sensitive simulation data, tamper with engineering models, or install malware. Given that Arena® is used in industrial and manufacturing environments, compromise of a workstation running this software could serve as a foothold for further lateral movement within operational technology (OT) or enterprise networks (Rockwell Advisory, CISA ICS Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-11918 as of the available data. The EPSS score is approximately 0.016% (0.000160), indicating a very low probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, though CISA did release an ICS advisory (ICSA-25-329-02) on November 25, 2025, highlighting the issue for industrial control system operators (CISA ICS Advisory, CISA Alert).

1. Craft a malicious DOE file: An attacker creates a specially crafted DOE (Design of Experiments) file containing oversized or malformed data in fields parsed by Arena®'s file parser, designed to overflow a stack buffer.
2. Deliver the file to the target: The attacker delivers the malicious DOE file to a user running a vulnerable version of Rockwell Automation Arena® (≤16.20.10) via email attachment, shared network drive, USB media, or social engineering.
3. Induce the victim to open the file: The attacker tricks the user into opening the malicious DOE file within Arena®, triggering the vulnerable parsing routine.
4. Trigger the buffer overflow: The malformed file data overflows a stack-based buffer during parsing, overwriting the return address or adjacent control data on the stack.
5. Achieve arbitrary code execution: With control of the instruction pointer, the attacker's shellcode or ROP chain executes in the context of the Arena® process, granting code execution with the victim user's privileges (Rockwell Advisory, CISA ICS Advisory).

• File System: Unexpected or unsolicited DOE files received via email, shared drives, or removable media; new executables or scripts created in user-writable directories following Arena® usage.
• Process: Unusual child processes spawned by the Arena® process (e.g., cmd.exe, powershell.exe, wscript.exe); Arena® crashing or generating application error logs when opening specific DOE files.
• Logs: Windows Event Log entries (Event ID 1000/1001) indicating Arena® application crashes or faults; Dr. Watson or Windows Error Reporting logs referencing Arena® with stack corruption details.
• Network: Unexpected outbound network connections from the Arena® process or newly spawned processes to external IP addresses following file open events.

Rockwell Automation has released Arena® version 16.20.11 to address this vulnerability, and users should upgrade immediately. As interim mitigations, organizations should restrict access to Arena® workstations, avoid opening DOE files from untrusted or unknown sources, and apply the principle of least privilege to user accounts running Arena®. CISA also recommends minimizing network exposure for ICS/SCADA systems and using secure file transfer practices (Rockwell Advisory, CISA ICS Advisory).

CISA released ICS Advisory ICSA-25-329-02 on November 25, 2025, as part of a batch of seven ICS advisories, drawing attention from the industrial cybersecurity community (CISA Alert). The vulnerability was noted in the Hawk-Eye weekly threat landscape digest for Week 49 of 2025, indicating moderate community tracking (Hawk-Eye Digest). No significant social media controversy or major researcher commentary beyond standard vulnerability tracking has been observed.