CVE-2025-2286
A local code execution vulnerability exists in the Rockwell Automation Arena® due to an uninitialized pointer. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.5
- CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.30%
- CWE
- CWE-457
- Published
- 2025-04-08
- Last modified
- 2026-03-12
Affected products
- Rockwell Automation Arena®
Weakness type
Related vulnerabilities
- CVE-2026-84391 — A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 may...
- CVE-2026-78935 — Use of uninitialized variable in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a...
- CVE-2026-62986 — OpenEXR: PyOpenEXR deep prefixed RGB stale lane disclosure
- CVE-2026-76919 — Use of Uninitialized Variable in Wireshark
- CVE-2026-17077 — IBM i is Affected By Multiple Vulnerabilities in DRDA / DDM
- CVE-2026-19212 — WonderTrader TraderATP Cash Trade Conversion WTSTradeDef.hpp uninitialized variable
- CVE-2026-19161 — Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who...
- CVE-2026-19160 — Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who...