CVE-2018-8843

Rockwell Automation Arena, en versiones 15.10.00 y anteriores, contiene una vulnerabilidad de uso de memoria previamente liberada (user-after-free) provocada por el procesamiento de archivos Arena Simulation Software especialmente manipulados que podrían provocar el cierre inesperado de la aplicación de software, pudiendo perder cualquier dato no guardado.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Rockwell Automation Arena. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of an Arena Model file. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the Arena process.