Read the docs
TI-2018-06385 Aliases CVE-2018-8843GHSA-r72j-mf7h-2cgh

Use after free in ICS-CERT Rockwell Automation Arena

Priority LOW 29CWE-416Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.

Summary

Rockwell Automation Arena versions 15.10.00 and prior contains a use after free vulnerability caused by processing specially crafted Arena Simulation Software files that may cause the software application to crash, potentially losing any unsaved data..

Why it matters now

EPSS 0.01957 80th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ICS-CERTRockwell Automation ArenaArena versions 15.10.00 and prior—No fix listedCNA
  • Rockwell Automation Arena VendorICS-CERT Affected Arena versions 15.10.00 and prior Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:rockwellautomation:arena:*:*:*:*:*:*:*:*up to 15.10.00VulnerableRockwell
  • cpe:2.3:a:rockwellautomation:arena:*:*:*:*:*:*:*:* Versions up to 15.10.00 Vulnerable ·Rockwell

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-8843
  2. 2026-10-03 Alias added: GHSA-r72j-mf7h-2cgh

References

Advisory 1

  • TI-2019-10142 Use after free in Rockwell Automation Arena Simulation Software versions 16.00.00 and… CVSS 3.0HIGH 7.8
  • TI-2023-13840 Rockwell Automation Arena Simulation Software Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2023-13839 Rockwell Automation Arena Simulation Software Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2019-10153 A maliciously crafted program file opened by an unsuspecting user of Rockwell Automation… CVSS 3.1HIGH 7.8
  • TI-2019-10151 Type confusion in Rockwell Automation Arena Simulation Software CVSS 3.1HIGH 7.8
  • TI-2023-13841 Rockwell Automation Arena Simulation Software Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
See all 45 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences