IM
IronMonkey Threat Research

CVE-2025-13844 HIGH

Published: 2026-01-15 | Last Modified: 2026-03-03 | Status: Analyzed

Description

CWE-415: Double Free vulnerability exists that could cause heap memory corruption when the end user imports a malicious project file (SSD file) shared by the attacker into Rapsody.

CVSS Metrics

Base Score: 5.3 (MEDIUM)

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionREQUIRED
ScopeUNCHANGED
Confidentiality ImpactLOW
Integrity ImpactLOW
Availability ImpactLOW

Source: [email protected]

Type: Primary

Exploitability Score: 1.8

Impact Score: 3.4

Base Score: 8.4 (HIGH)

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack VectorLOCAL
Attack ComplexityLOW
Attack RequirementsNONE
Privileges RequiredNONE
User InteractionACTIVE
Vulnerability ConfidentialityHIGH
Vulnerability IntegrityHIGH
Vulnerability AvailabilityHIGH
Subsequent ConfidentialityLOW
Subsequent IntegrityLOW
Subsequent AvailabilityLOW

Source: [email protected]

Type: Secondary

Weaknesses

Source Type Description
[email protected] Primary
en CWE-415

Affected Products

Vendor Product Version Update Type
schneider-electric ecostruxure_power_build_-_rapsody * <built-in method update of dict object at 0x7e60bafacf80> Application
schneider-electric ecostruxure_power_build_-_rapsody * <built-in method update of dict object at 0x7e60bafac200> Application
schneider-electric ecostruxure_power_build_-_rapsody * <built-in method update of dict object at 0x7e61109d6100> Application
schneider-electric ecostruxure_power_build_-_rapsody * <built-in method update of dict object at 0x7e60a8895480> Application
schneider-electric ecostruxure_power_build_-_rapsody * <built-in method update of dict object at 0x7e60bafae740> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:schneider-electric:ecostruxure_power_build_-_rapsody:*:*:*:*:fr:*:*:*
Yes cpe:2.3:a:schneider-electric:ecostruxure_power_build_-_rapsody:*:*:*:*:bel_nl:*:*:*
Yes cpe:2.3:a:schneider-electric:ecostruxure_power_build_-_rapsody:*:*:*:*:es:*:*:*
Yes cpe:2.3:a:schneider-electric:ecostruxure_power_build_-_rapsody:*:*:*:*:int:*:*:*
Yes cpe:2.3:a:schneider-electric:ecostruxure_power_build_-_rapsody:*:*:*:*:bel_fr:*:*:*

References

Notification
Message here