CVE-2025-13844

Published: Jan 15, 2026Modified: Jun 17, 2026

8.4

Vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: cybersecurity@se.com (Secondary)

Description

CWE-415: Double Free vulnerability exists that could cause heap memory corruption when the end user imports a malicious project file (SSD file) shared by the attacker into Rapsody.

Affected (5)

Products: Schneider Electric: Ecostruxure Power Build Rapsody

Schneider Electric

1 product

Ecostruxure Power Build Rapsody

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Schneider Electric Ecostruxure Power Build Rapsody	Up to 2.8.8
Schneider Electric Ecostruxure Power Build Rapsody	Up to 2.8.3
Schneider Electric Ecostruxure Power Build Rapsody	Up to 2.8.5
Schneider Electric Ecostruxure Power Build Rapsody	Up to 2.8.1
Schneider Electric Ecostruxure Power Build Rapsody	Up to 2.8.6

Related CWEs

CWE-415

Double Free

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

References (1)

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-013-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-013-04.pdf

Source: cybersecurity@se.com

Vendor Advisory

Timeline

No history available yet.