This vulnerability (CVE-2026-8085) in Arena® Simulation involves an out-of-bounds write due to insufficient validation of user input in the model.exe (Siman) component. An attacker can craft a malicious file that, when opened by a user, triggers memory corruption enabling arbitrary code execution with the privileges of the current user. The CVSS 4.0 score is 7.0, indicating high severity. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

Successful exploitation can lead to arbitrary code execution in the context of the current user process, potentially allowing an attacker to execute malicious code on the affected system. The attack requires local access and user interaction (opening a malicious file). There is no indication of remote exploitation without user action or privilege escalation beyond the current user.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid opening untrusted or suspicious files with Arena® Simulation. Monitor Rockwell Automation's advisories for updates on patches or mitigations.