CVE-2026-8085
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A memory corruption vulnerability exists in Arena® Simulation within the model.exe (Siman) component due to improper validation of user-supplied data, leading to an out-of-bounds write. An attacker can exploit this to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.
Risk Assessment
The risk for the organization includes potential arbitrary code execution by an attacker, which could lead to system compromise, data theft, or application disruption. User interaction (opening a file) is required, which mitigates but does not eliminate the threat.
Recommendation
Immediately update Arena® Simulation to the latest patched version. Additionally, train users to avoid opening suspicious files and implement policies to restrict execution of unverified attachments.
Other vulnerabilities in Arena Simulation
See all- CVE-2026-8314High
A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the siman.exe (Siman) component. Improper validation of user-supplied data can result in an out-of-bounds write.
- CVE-2026-8313High
A memory corruption vulnerability exists in Arena® Simulation within the linker.exe (Siman) component due to improper validation of user-supplied data, leading to an out-of-bounds write.
- CVE-2026-8312High
A memory corruption vulnerability in Arena® Simulation's expmt.exe (Siman) component due to improper validation of user-supplied data leads to an out-of-bounds write. An attacker can exploit this to execute arbitrary code in the current process context by tricking a user into opening a malicious file.
Original NVD description (English source)
A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the model.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.