CVE-2025-13844

MEDIUM

EcoStruxure Power Build - Rapsody < 2.8.8 - Double Free via Malicious SSD File Import

Title source: llm

Description

CWE-415: Double Free vulnerability exists that could cause heap memory corruption when the end user imports a malicious project file (SSD file) shared by the attacker into Rapsody.

References (1)

Core 1

Core References

Various Sources

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-013-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-013-04.pdf

Scores

CVSS v3 5.3

EPSS 0.0014

EPSS Percentile 3.5%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-415

Status published

Products (5)

schneider-electric/ecostruxure_power_build_-_rapsody < 2.8.1

schneider-electric/ecostruxure_power_build_-_rapsody < 2.8.3

schneider-electric/ecostruxure_power_build_-_rapsody < 2.8.5

schneider-electric/ecostruxure_power_build_-_rapsody < 2.8.6

schneider-electric/ecostruxure_power_build_-_rapsody < 2.8.8

Published Jan 15, 2026

Tracked Since Feb 18, 2026