Which versions of EcoStruxure Rapsody are affected by CVE-2025-13844?

Schneider Electric's EcoStruxure Power Build - Rapsody contains a heap memory corruption vulnerability enabling arbitrary code execution when engineers import malicious SSD project files.

How to fix or mitigate CVE-2025-13844?

Within 24 hours, alert engineering teams of the import risk, require senior review for all external SSD files, and restrict EcoStruxure software execution to limited user accounts without administrative privileges. Within 7 days, implement network segmentation isolating design workstations from production environments, deploy endpoint controls blocking SSD file imports from untrusted sources, and disable SSD import functionality if not operationally essential. Within 30 days, contact Schneider Electric support to confirm patch timeline and availability, evaluate contingency design tooling, and deploy application-layer monitoring to detect abnormal file access patterns on affected workstations.

EcoStruxure Rapsody CVE-2025-13844

Q: What is the CVSS score of CVE-2025-13844?

CVE-2025-13844 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Double Free (CWE-415)

2026-01-15 cybersecurity@se.com

Schneider Electric Ecostruxure Power Build Rapsody

8.4

CVSS 4.0 · Vendor: se

Severity by source

Vendor (se) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local file-based delivery with required user import action; no attacker privileges on target system needed; full process-level CIA impact from successful heap corruption.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from Vendor (se).

CVSS VectorVendor: se

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Metadata Corrected

Sep 03, 2026 - 03:40 vuln.today

tag: Buffer Overflow removed

Analysis Updated

Sep 03, 2026 - 03:31 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 03, 2026 - 03:22 vuln.today

cvss_changed

Severity Changed

Sep 03, 2026 - 03:22 NVD

MEDIUM HIGH

CVSS changed

Sep 03, 2026 - 03:22 NVD

5.3 (MEDIUM) 8.4 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 15, 2026 - 19:16 nvd

MEDIUM 5.3

DescriptionCVE.org

CWE-415: Double Free vulnerability exists that could cause heap memory corruption when the end user imports a malicious project file (SSD file) shared by the attacker into Rapsody.

AnalysisAI

Heap memory corruption via double free in Schneider Electric's EcoStruxure Power Build - Rapsody enables arbitrary code execution when an engineer imports a crafted SSD project file delivered by an attacker. The vulnerability spans all localized editions of the software (French, Belgian Dutch, Spanish, International, and Belgian French) with no upper version bound confirmed in NVD CPE data. No public exploit has been identified and no CISA KEV listing exists; however, the file-based social engineering delivery path is realistic and well-suited to targeted attacks against industrial design personnel.

Technical ContextAI

EcoStruxure Power Build - Rapsody is Schneider Electric's IEC 61439-oriented panel-board and power distribution switchgear design application, distributed in multiple regional editions as captured in CPE strings (cpe:2.3:a:schneider-electric:ecostruxure_power_build_-_rapsody:*:*:*:*:[fr|bel_nl|es|int|bel_fr]:*:*:*). The root cause is CWE-415 Double Free - a memory management defect where the same heap allocation is released twice during SSD project file parsing. After the first free, the allocator's internal metadata for that chunk is corrupted; a second free of the same pointer allows an attacker-controlled heap layout that can redirect control flow. Double Free is categorically distinct from buffer overflow despite overlapping heap-corruption outcomes; the underlying defect is a missing pointer nullification after deallocation in the file import code path.

RemediationAI

Apply the patch documented in Schneider Electric Security Advisory SEVD-2026-013-04 (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-013-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-013-04.pdf); the specific fixed build version is not independently determinable from available NVD or CPE data and must be confirmed directly from the advisory. Until patching is complete, organizations should instruct all Rapsody users to import SSD project files only from verified, internally generated sources and to transfer project files exclusively via integrity-checked, access-controlled channels rather than general email or uncontrolled file shares. As an additional compensating control, running Rapsody in a dedicated sandboxed virtual machine isolated from OT network segments when processing externally sourced project files limits lateral movement potential if exploitation occurs; note this introduces operational overhead for file transfer and licensing verification workflows.